linuxfoundation

Use when adding a new snowflake-connector data source to crowd.dev — a new platform or a new source within an existing platform that needs buildSourceQuery, transformer, activity types, migration, and all associated type registrations scaffolded.

Central explainer for how LFX V2 wrapper services integrate with ITX (the Linux Foundation IT backend) and with the legacy v1 system. Covers OAuth2 M2M to ITX via private key JWT assertion, v2 UUID to v1 Salesforce ID mapping via the NATS request/reply subject `lfx.lookup_v1_mapping`, v1 to v2 event sync via NATS JetStream KV bucket watchers, and the canonical `ITX_*` environment variable contract. Fires on prompts like "ITX", "OAuth2 M2M to ITX", "ID mapping v1 v2", "Salesforce SFID mapping", "v1 KV event sync", "lfx.lookup_v1_mapping", "ITX_CLIENT_ID", "ITX_CLIENT_PRIVATE_KEY", "ITX_AUDIENCE", "ITX_BASE_URL", "JetStream KV watcher", "v1 to v2 sync", "wrapper service ITX", "private key JWT assertion", "id mapper", "v1-objects bucket", "EVENT_STREAM_NAME", "EVENT_CONSUMER_NAME". Read-only; routes implementation work to the owning wrapper repo.

Central explainer for how the LFX V2 platform components compose: Self Serve, Goa services, NATS, JetStream KV, fga-sync, OpenFGA, indexer-service, OpenSearch, query-service, access-check, Heimdall, Gateway API, Auth0, Helm, and ArgoCD. Use when tracing platform write, read, access-check, authorization, indexing, deployment, service-classification, or cross-repo ownership flows. Fires on prompts like "how does FGA flow", "where does the indexer fit", "what's the platform shape", "native service", "wrapper service", "new V2 service", "Heimdall vs FGA", "what owns the OpenFGA model", "how does query-service read resources", "how does access-check work", "which repo owns deployed values", or "which service consumes index messages". Do not use for V2 Go service coding conventions; the owning repo's path-scoped `<short-repo-name>-dev` skill should attach after routing.

LFX cross-repo topology and ownership router. Use when the task spans more than one LFX repo, asks "which repo owns X", "where does Y live", "what repos does this touch", "what consumes Z", or needs a peer-repo file path from inside a single repo. Loads per-repo configs when invoked from the LFX workspace root with a full task prompt; gives targeted cross-repo guidance when invoked from inside a single repo. Also answers LFX glossary and topology questions, and performs read-only discovery when the user asks whether a contract, API, event, field, workflow, or repo capability exists. Do not fire for single-repo implementation tasks where the active repo's own CLAUDE.md already governs (those belong to the repo's local skills). Do not fire for V2 platform composition, service classes, or cross-service handoffs (use `/lfx-skills:lfx-platform-architecture`), ITX wrapper plumbing (`/lfx-skills:lfx-itx-integration`), or Intercom app/Fin workflows (`/lfx-skills:lfx-intercom`).

Combine multiple feature branches across repos into worktrees for end-to-end journey testing. Create, refresh, and teardown integration environments that merge branches from multiple repos.

Guide non-dbt developers through building PR-ready data models, tests, and transformations in the lf-dbt repo. Encodes the medallion architecture (bronze/silver/gold/platinum), Snowflake SQL conventions, sqlfluff formatting, dbt testing patterns, key macros, and data governance rules. Use this skill any time someone asks about writing dbt models, adding data tests, creating SQL transformations, fixing pipeline failures, or contributing to the lf-dbt repository.

Interactive setup guide for LFX contributors to configure Git for DCO signoff and GPG-signed commits. Use this skill whenever someone asks about setting up Git signing, DCO signoff, GPG keys for commits, configuring `~/.gitconfig` for signing, adding a GPG key to GitHub, or any variation of "how do I sign my commits?". Also trigger it when a user says their commits aren't showing as "Verified" on GitHub, when they're onboarding to an LFX project and need to meet contribution requirements, or when they ask about `git commit -s`, `--signoff`, `Signed-off-by`, or `commit.gpgSign`. This skill works for technical and non-technical users alike.

Everything Intercom for LFX — Angular app integration (code) and Fin AI optimization (support/CX). Use this skill for: adding or fixing Intercom in an LFX Angular app, auditing integrations against the LFX canonical pattern, correcting missing JWT pre-set, broken shutdown, missing Auth0 claim, wrong app IDs, or absent CSP entries — AND for Fin Guidance writing, Help Center optimization, resolution rate improvement, Fin escalation patterns, Copilot tips, Topics Explorer, Fin Attributes, daily review rituals, and Fin best practices. Routes to the right section based on context. Trigger on: any Intercom question, "Fin tips", "improve Fin", "Fin guidance", "Fin resolution rate", "Help Center optimization", "Copilot tips", "Angular Intercom", "IntercomService", "JWT Intercom", "Fin re-engagement", "Fin handoff", or any Intercom-related support or development question.

Guided development workflow for building, fixing, updating, or refactoring code, components, services, backend endpoints, shared types, or full features. Use whenever someone wants to add a feature, fix a bug, modify existing code, create something new, refactor, or implement any code change.

Use when building or modifying a Self Serve drawer component — slide-in detail panels with lazy data loading, chart integration, two-way `[(visible)]` bindings, and the standard responsive width class chain. Trigger phrases include "building a drawer", "open in a drawer", "drawer component", "lazy-load on open", "side panel".

Use when touching Self Serve dashboards, persona behavior, lens switching, `LensService`, `ProjectContextService`, or any code that varies behavior by user persona (Contributor, Maintainer, ED, Board Member, Admin Mode). Trigger phrases include "lens", "persona", "ED mode", "Admin Mode", "PCC", "dashboard variant".

Review a pull request against LFX architecture standards. Requires the reviewer's HEAD to be the PR's branch (author scenarios are natural; external reviewers run `gh pr checkout <N>` first). Fetches main fresh, then launches `lfx-skills:lfx-general-code-reviewer` and `lfx-skills:lfx-self-serve-code-reviewer` in full-branch mode. The subagents audit the PR branch's diff against `origin/main` and render markdown reports covering general code review, upstream API contracts, and repo conventions (rules, checklists, architecture). This skill body adds what only a post-PR skill can do: verifying prior review comments are addressed, walking the PR-shape checklist (branch/ JIRA/commits/DCO+GPG/rebase/diff-size/protected-files/PR-title/external-refs), applying new-contributor educational tone, presenting a draft for explicit approval, and posting via /review only after user go-ahead. NEVER auto-posts comments or submits reviews. Use when reviewing PRs, checking PR quality, validating code changes, or when the user sa

Pre-PR shape check on local lfx-self-serve work. Audits PR-shape sanity (branch name, JIRA reference, conventional-commit format, rebase status, DCO + GPG signing per commit, total diff size, and protected files touched) against the target base branch. Does NOT audit code, code audits run post-commit via the central reviewer trio (see `.claude/rules/skill-guidance.md` for canonical post-commit reviewer-trio launch instructions). Use once before opening a PR, after the post-commit review queue has returned clean.

Use when publishing or subscribing to NATS from the Self Serve Express BFF — touching `nats.service.ts`, sending NATS requests, consuming subjects, or troubleshooting NATS connectivity. Trigger phrases include "NATS publish", "NATS subscribe", "NATS request", "nats.service", "project RPC", "inter-service messaging".

Use when a Self Serve backend endpoint returns lists, when you need cursor pagination (`page_token` / `page_size`) against the query service, or when fetching all pages of a resource via the `fetchAllQueryResources` helper. Trigger phrases include "paginated endpoint", "page_token", "page_size", "infinite scroll backend", "list endpoint", "fetch all pages".

Mechanical pre-PR pipeline, license headers, format, lint, build, protected file check, commit verification, and PR change summary. Run after the post-commit reviewer trio has been drained and `/lfx-self-serve-pr-readiness` has passed. Pattern/convention auditing is owned by the central reviewer trio (see `.claude/rules/skill-guidance.md` for canonical post-commit reviewer-trio launch instructions), not by this skill.

Cut a new GitHub release/tag for lfx-v2-newsletter-service from main, verify the tagged build published the image and Helm chart, then open a version-bump PR on lfx-v2-argocd pinning the target environments to the new version. Use when the user asks to "cut a release", "release a new version", or "bump the newsletter service in argocd".

How to drive an open lfx-v2-newsletter-service pull request through the agentic review flow: read the lfx-reviewer "Agentic review check" comment, fix or rebut every blocking finding, answer every review thread, push one batched round at a time, and loop until the check is green on the current head with every thread answered — then report the ending: needs-human review before merge, or clear for the gate/automerge path. Use whenever a PR is open on this repo and the work involves review iteration — responding to Copilot or conductor findings, checking why `agentic-review/clean` is failing or why the gate has not approved, handling the `needs-human` label, or pushing fixes to an open PR. This is the PR driver's operating manual: the driver is a worktree-isolated background agent that works the PR autonomously (fixes, rebuttals, replies, pushes). The main session only launches the driver right after opening any PR here — with a minimal prompt pointing at this skill — and relays its round notes.

The exact format for the two verdict comments the agentic review posts on a lfx-v2-newsletter-service pull request: the needs-human verdict (escalation) and the agentic-check verdict (conductor). Use whenever you post either verdict. Defines the human presentation and the machine-readable markers that the deterministic apply step parses, so writer and reader stay in sync.

Conduct an lfx-v2-newsletter-service pull request to a clean state: reconcile the AI reviewers' threads against the latest commits and developer replies, work with the engineer on findings that go against the architecture, and report whether the change is clean. Use when the task is to check whether AI-review findings are fixed or validly rebutted and to update the agentic gate. Posts one machine-readable agentic-check comment plus a summary of open blockers.

Decide whether an lfx-v2-newsletter-service pull request needs a human's sign-off before it can merge (the needs-human gate), regardless of code quality. Use when the task is the needs-human escalation on a PR. Posts a single machine-readable needs-human verdict comment via add_issue_comment.

Senior code-review method for lfx-v2-newsletter-service pull requests. Use when the task is to review a PR for correctness, design, and security and post review comments on this repo. Posts inline severity-tagged comments plus a summary on the PR itself.

Detailed boundaries behind the needs-human decision for lfx-v2-newsletter-service: the critical surfaces (auth, the unauthenticated surface, schema, send behavior), shared and cross-repo contracts, scale-with-importance, and pipeline/supply-chain. Load this whenever judging whether a newsletter-service PR needs a human, as the detail behind the `needs-human-escalation` skill.

How to judge the implementation of an lfx-v2-newsletter-service pull request: the general quality dimensions (correctness, error handling, tests, performance, readability, code truthfulness) and how to hold the diff to the repo's documented standards. Use on every PR that changes code, however small; this is the reviewer's line-level lens. Security has its own skill (newsletter-security-review).

Scaffold a new sub-worker inside packages_worker (npm, deps.dev, osv, scorecard, etc.) following the single-service multi-entry-point structure. Use when: "add a new packages worker", "scaffold a sub-worker in packages_worker", "new worker for packages-db", "add npm worker", "add OSV worker", "add deps.dev worker".

Get packages_worker running locally — first time or resuming after a break. Spins up packages-db if not running, applies any pending migrations, and starts the worker. All steps are safe to re-run. Use when: "set up packages worker", "start packages worker", "resume packages worker", "get packages-db running", "packages-db stopped", "restart the worker".

Record an architecture decision as an ADR in docs/adr/. Use when choosing between frameworks, libraries, databases, or architectural patterns; stating a decision with reasoning ("we decided X instead of Y because..."); or querying past decisions ("why did we choose X?").

Generate a commit message and commit staged changes using git commit -s -S.

Recover from missing DCO sign-off on commits. Handles the single-commit amend, older-commit recovery via interactive rebase or cherry-pick, and explains the Probot DCO check that blocks PRs without sign-off. Use when a PR fails the DCO check, when a commit needs a Signed-off-by trailer added retroactively, or when sign-off was forgotten during rebase / cherry-pick / amend.

Pre-PR validation — working tree status, format, lint, TypeScript check, and protected file check. Workspace-aware: detects which of backend/, frontend/, services/apps/*, services/libs/* were changed and runs only the relevant scripts. Use before submitting any PR, to check if code is ready, or to validate a branch before review.

Review a pull request against CDP architecture standards — fetches PR diff, verifies previous comments are addressed, validates PR metadata (title, branch, JIRA key, size), runs a code-standards enforcer against every file in `.claude/rules/` and `.claude/hooks/guard-protected-files.sh`, and drafts inline review comments with suggested fixes. NEVER auto-posts comments or submits reviews — always presents a draft in the terminal for user approval before any comment lands on the PR. Use when reviewing PRs, checking PR quality, validating code changes, or when the user says "review", "check this PR", or "audit code".

Use when adding a new snowflake-connector data source to crowd.dev — a new platform or a new source within an existing platform that needs buildSourceQuery, transformer, activity types, migration, and all associated type registrations scaffolded.

Automated triage and fixing of Dependabot security vulnerabilities (IN-1189). Starts by asking which scope to tackle (critical, high, medium/low, or specific advisories) with checkboxes. Fetches open alerts, dedupes them, classifies each by origin (submodule vs local, dev-only vs runtime), then fans out one break-risk agent per package that must PROVE the update is safe for this codebase before any fix is applied. Applies safe fixes one at a time with incremental validation and ends with a report of what was fixed and what needs a human. Fixing only: NEVER runs git operations (no branch, commit, push, or PR) and produces no commit/PR drafts — reviewing and shipping the changes is entirely up to the user. Never dismisses alerts or auto-applies major version bumps. Use when the user says "fix vulns", "fix vulnerabilities", "dependabot alerts", "security audit fix", or invokes /fix-vulns.

Record an architecture decision as an ADR in docs/adr/. Use when choosing between frameworks, libraries, databases, or architectural patterns; stating a decision with reasoning ("we decided X instead of Y because..."); or querying past decisions ("why did we choose X?").

Generate a commit message and commit staged changes using git commit -s -S.

Pre-PR validation — license headers, format, lint, TypeScript check, build, and protected file check. Use before submitting any PR, to check if code is ready, validate changes, or verify a branch before review.

Review a pull request against Insights architecture standards — fetches PR diff, verifies previous comments are addressed, validates PR metadata (title, branch, JIRA, size), runs a code-standards check against every file in `.claude/rules/` and `.claude/hooks/guard-protected-files.sh`, and drafts inline review comments with suggested fixes. NEVER auto-posts comments or submits reviews — always presents a draft in the terminal for user approval before any comment lands on the PR. Use when reviewing PRs, checking PR quality, validating code changes, or when the user says "review", "check this PR", or "audit code".

Run the docs site, blog, or Storybook locally. Use when contributing to documentation, previewing blog posts, or developing UI components in isolation. Not needed for regular frontend development.

Full development environment setup from scratch — prerequisites, dependencies, .env file, optional local PostgreSQL database (for auth/collections/chat work), and dev server. Use for first-time setup, broken environments, missing env vars, or when the app won't start.

Path-scoped Go and Goa conventions for the lfx-v2-member-service repo. Auto-attaches when editing Go implementation, Goa design files, NATS KV cache code or request/reply handlers, logging, pagination, errors, request context, generated-code boundaries, tests, lint, formatting, or license headers. Inline guidance covers conventions every Go file in this repo follows, plus a Salesforce-integration callout. References cover repo-local NATS/KV contracts and the broader development workflow. Central platform composition stays in lfx-skills:lfx-platform-architecture; the membership endpoint workflow stays in the local member-add-endpoint skill.

Use when adding a new HTTP endpoint to the lfx-v2-member-service (b2b_org, b2b_org settings, project membership, key contacts, admin actions, or related membership resources). Covers the Goa design update, regeneration, handler implementation, test scaffolding, and the Heimdall ruleset update that authorization requires. Also use when modifying an existing endpoint's signature in a way that triggers a regen + ruleset update.

Shape-only pre-PR check for local lfx-v2-member-service work. Audits the branch name, LFXV2 ticket reference, conventional commit subjects, rebase status, DCO and GPG signing per commit, total diff size, and protected member-service files touched against the target base branch. Does not audit code behavior or run build/test/lint checks; run /member-service-preflight after this passes.

Mechanical pre-PR pipeline for lfx-v2-member-service. Runs the Go-specific working tree, license header, formatting, lint, build, tests, protected file, commit verification, and change-summary checks after /member-service-pr-readiness has passed. Supports default validation and report-only dry-run mode.

Use when building any UI element in the crowdfunding frontend — covers when to use existing uikit components, how to extend them, and when to ask before creating new ones

Use when working on Nuxt 4+ projects - provides server routes, file-based routing, middleware patterns, Nuxt-specific composables, and configuration with latest docs. Covers h3 v1 helpers (validation, WebSocket, SSE) and nitropack v2 patterns. Updated for Nuxt 4.3+.

Use when editing .vue files, creating Vue 3 components, writing composables, or testing Vue code - provides Composition API patterns, props/emits best practices, VueUse integration, and reactive destructuring guidance

Populate @fgadoc:jtbd annotations in the OpenFGA model by scraping live API authorization rules from the dev Kubernetes cluster and synthesizing JTBD statements. Use when the model has new types or relations that need JTBD annotations refreshed.

Render PERMISSIONS.md from @fgadoc annotations in the OpenFGA model. Use after any change to model.fga to keep the human-readable permissions reference in sync.

Use when the user wants to bring up the local LFX platform stack, edit the OpenFGA authorization model and re-render permissions docs, update platform chart dependencies, or debug local stack install/sync issues. Fires on "bring up local LFX platform", "edit OpenFGA model", "update platform chart dependencies", "debug local stack".

Repo-local Go coding conventions for lfx-v2-project-service. Auto-attaches when editing Go files, Goa design files, Makefile, go.mod/go.sum, or anything under api/, cmd/, internal/, pkg/, or gen/. Owns logging, errors, request context, pagination, generated-code boundary, NATS/KV publishing, tests, formatting, linting, and license headers for this repo. Central architecture, V2 service classes, and cross-repo handoffs stay in /lfx-skills:lfx-platform-architecture; cross-repo ownership questions stay in /lfx-skills:lfx.

Mechanical pre-PR pipeline for lfx-v2-project-service. Checks working tree status, license headers, Go formatting, lint, build, tests, project-service protected files, commit verification, generated-code freshness, and PR change summary. Run after /project-service-pr-readiness has passed. Supports report-only or dry-run mode.

Pre-PR shape check for local lfx-v2-project-service work. Audits branch name, JIRA reference, conventional commits, rebase status, DCO plus GPG signing, total diff size, and project-service protected files against the target base branch. Shape only: no Go code audit, no lint/build/test execution, and no PR side effects. Run before /project-service-preflight.

Repo-local development conventions for the lfx-v2-committee-service. Auto-attaches on Go implementation paths (cmd/, internal/, pkg/, gen/), Goa design files under cmd/committee-api/design/, repo docs, the service-local Helm chart, Makefile, go.mod, and go.sum. Owns the generated-code boundary, slog logging via pkg/log, the pkg/errors domain-error family and its Goa mapping, request-context propagation through pkg/constants keys, NATS subject / KV / Object Store coding rules, committee-owned indexer and FGA contract docs, service chart wiring, table-driven tests with internal/infrastructure/mock fakes, gofmt and golangci-lint hygiene, and license headers. Central platform composition, V2 service classes, and cross-repo handoffs stay in lfx-skills:lfx-platform-architecture. Cross-repo topology and routing stay in lfx-skills:lfx. Committee-domain contracts (indexer-contract.md, fga-contract.md, invite-application-flows.md) are authoritative for what this service emits.

Pre-PR shape check for local lfx-v2-committee-service work. Audits branch name, JIRA reference, conventional commits, rebase status, DCO and GPG signing, total diff size, and repo-specific protected files against the target base branch. Does not audit Go code, generated output correctness, contracts, charts, or tests; run /committee-service-preflight after this shape check passes.

Mechanical pre-PR validation for lfx-v2-committee-service. Checks working tree state, license headers, Go formatting, golangci-lint, API and CLI build, Go tests, repo-specific protected files, commit verification, and PR change summary. Run after /committee-service-pr-readiness has passed. Supports report-only or dry-run mode when requested.

Repo-local Go coding conventions and implementation guidance for lfx-v2-email-service. Auto-attaches when editing Go code, NATS subjects and payloads, SMTP/SES/SQS tracking code, Makefile, Helm chart templates, or service-owned docs. Owns the email-service public NATS contract, tracking KV behavior, SMTP sender boundary, SES engagement poller, tests, formatting, linting, and license headers. Central platform composition stays in lfx-skills:lfx-platform-architecture; cross-repo routing stays in lfx-skills:lfx.

Repo-local mechanical pre-PR pipeline for lfx-v2-email-service. Runs Go working-tree checks, license headers, formatting, lint, build, tests, protected-file reporting, commit verification, and PR change summary. Run after /email-service-pr-readiness.

Repo-local pre-PR shape check for lfx-v2-email-service. Audits only branch and PR hygiene: branch name, JIRA reference, conventional commits, rebase status, DCO plus GPG signing, total diff size, and email-service protected files. Does not audit Go code or architecture. Run before /email-service-preflight.

Upgrade all Go dependencies, fix payload/contract changes introduced by upstream LFX V2 services, and run a query service argument review pass. Use when upgrading dependencies, after upstream service contract changes, or for periodic maintenance of the lfx-mcp codebase.

Validate MCP search tool filter parameters against the live OpenSearch resources index and upstream indexer-contract documentation. Use after any filter bug report or indexer contract change to identify broken, missing, or incorrectly implemented filter parameters.