compass

Use at the START of any task in a compass-enabled repo, or whenever you're unsure which capability fits. Indexes compass's guardrails, red-team, router, commands, subagents, and skills so you reach for the right tool instead of working ad-hoc. Read this before hand-writing config, reviewing a diff, adding a dependency, picking a model, or running untrusted code.

Take every open PR end-to-end — diagnose failing checks, classify them (real defect vs mechanical vs environmental), fix the mechanical ones on the PR branch, re-verify, and stop at the merge gate. Use on demand ("handle the open PRs") or on an interval via /loop (e.g. "/loop 15m /pr-shepherd"). Merges only when the human has granted merge authority in the current session; otherwise reports ready-to-merge.

Discovery for an autonomous loop — find this turn's work instead of being handed it. Reads what changed since the last run (failed CI, new issues, merged commits), judges what's actually worth acting on, writes findings to a durable state file, and hands each off to the SDLC loop with a stop-condition. Use as the first move of a scheduled loop, or by hand to plan a session. Read-only on code; never edits, opens PRs, or merges.

Use when something is broken — a failing test, panic, stack trace, error log, or wrong behavior whose cause isn't obvious. Reproduce it, form a hypothesis, PROVE the cause before changing code, then make the minimal root-cause fix and guard it with a test. For deep cases, hand off to the debugger subagent.

Use before claiming ANY task done, fix verified, check passing, or PR ready. Establish how the change is checked and actually run it — tests, typecheck, lint, the local gate, or the app itself — and observe it pass. Never report "should work" or pass along a subagent's unproven claim.

Run the toolkit's security commands in order to surface secrets, MCP supply-chain issues, install drift, release provenance gaps, and untrusted-code risks before shipping. Use before opening a PR, after adding a dependency, or whenever the security posture needs a fresh check.

Detect the work type of a task or diff and dispatch the right specialist review/agent. Use when you're about to review or implement and want the correct domain reviewer (UI/design, API/devex, infra, docs, core) instead of a generic pass. The local mirror of the SDLC Classifier + domain-routed reviewers.

Generate a high-quality project CLAUDE.md and AGENTS.md by inspecting the current repository. Use when a repo has no agent config, when onboarding a new project, or when the user asks to "set up Claude/Codex for this repo" or "write a CLAUDE.md". Detects languages, build/test commands, and structure, then drafts config grounded in what's actually there.