stagecraft

Platform Developer: Stage 8 deploy task. Adapter-driven deployment — read config.yml for the adapter, follow adapter instructions, write deploy-log.md and stage-08.json.

Platform Developer: Stage 4 build task. Docker Compose setup, infra config, PR summary authoring, and Stage 4 gate writing for the platform workstream.

G7 — apply property-based testing, mutation testing, and formal verification as a stage-06d sub-stage. "Tests pass" becomes the floor; this skill raises the ceiling. Use after stage-06 PASS, when the diff contains pure functions / critical business logic / state machines worth verifying beyond examples.

Run a structured codebase audit — map architecture, assess health (compliance / tests / docs), perform deep analysis (security / performance / code quality), and synthesize a prioritized roadmap. Use this skill when the user says things like 'audit the codebase', 'understand this project', 'find problems', '/audit', or '/audit-quick'. Phases produce machine-friendly markdown outputs under docs/audit/ that downstream commands (like the implement skill) consume to know where to start work.

QA Developer: Stage 6 test-authoring phase. Map every acceptance criterion to at least one test, write the test suite, and produce pipeline/pr-qa.md. Does NOT run the suite — that is the test-execution phase (skills/qa-test-execution/SKILL.md).

Verify at Stage 6c that every metric, log, and trace promised in the design-spec is actually emitted by the shipped code. Runs on full and hotfix tracks only. Produces the stage-06c gate. Use when the platform role owns observability sign-off after build and QA.

Platform Developer: Stage 4a pre-review task. Run lint, type-check, SCA, license check, security trigger, and hygiene checks. Produce pipeline/gates/stage-04a.json.

QA Developer: Stage 4c-qa post-red-team test augmentation. Write regression tests for every addressed red-team finding before Stage 5 begins. Only fires after red-team WARN/PASS following fix cycles.

QA Developer: Stage 6 test-execution phase. Run the full test suite, produce pipeline/test-report.md, and write pipeline/gates/stage-06.json. Use after test authoring (skills/qa-test-authoring/SKILL.md).

Standard code review checklist for all reviewers. Load this when performing a peer review at Stage 5. Covers spec compliance, correctness, security, test coverage, readability, and performance. Defines what constitutes APPROVED vs CHANGES_REQUESTED and how to write review findings.

Review the current branch before creating a pull request. Use this skill whenever the user says 'review my changes', 'review this branch', 'pre-PR review', 'check before I merge', 'is this ready to merge', 'review before PR', or 'code review'. Also triggers on 'check my work' or 'anything I missed?' when there are uncommitted or branch-level changes. This skill is for changes made OUTSIDE the /pipeline — the pipeline has its own Stage 5 peer review. Use this after direct edits, implement skill work, or /hotfix runs.

Run an adversarial review on what was just built. Use this skill when the user says 'red team this', 'find what could break', '/red-team', or when the orchestrator invokes the red-team role for stage-04c. The skill walks 10 attack surfaces, produces concrete reproducers (not vibes), triages findings by severity × likelihood × scope, and writes pipeline/red-team-report.md + pipeline/gates/stage-04c.json. Output is read by the implementer to address must-fix items before Stage 5 peer review begins.

Measure Lighthouse performance scores, bundle size delta, and/or k6 load-test throughput at Stage 6e. Compares against project budgets (performance.budget.json or .devteam/config.yml defaults). Produces pipeline/performance-report.md and writes the stage-06e gate. Gate FAILs when any budget is exceeded. Skip with skipped_reason for changes with no performance-relevant surface.

Project-wide API design standards. Load this when designing or implementing REST endpoints, request/response shapes, status codes, versioning, or pagination. Defines conventions for resource naming, HTTP method usage, error response format, and header requirements.

Project-wide coding standards for naming, formatting, error handling, security, and testing. Load this when writing or reviewing code. Covers all layers (files, functions, classes, constants, database columns) and languages in use. Do not duplicate these rules in agent prompts — load this skill instead.

Security review checklist. Load this during design review, implementation, and code review. Every item is a potential BLOCKER if violated. Covers input validation, authentication/authorisation, data handling, secrets management, dependency hygiene, and logging. Use alongside the security role brief at Stage 4b.

Run a WCAG accessibility audit on UI changes at Stage 6b. Uses axe-core, pa11y, or Lighthouse to check affected pages and components. Produces pipeline/accessibility-report.md and writes the stage-06b gate. Use when a change touched frontend UI. Skip (with audit_skipped_reason) for backend-only or doc-only changes.

G2 — translate a numbered acceptance-criteria list (AC-1, AC-2, ...) from pipeline/brief.md into Gherkin scenarios in pipeline/spec.feature. One Scenario per AC, tagged @AC-N. Drives stage-03b (executable-spec) and enables zero-drift mapping through QA.

Review the migration-safety story for a data-layer change at stage-04d. Use this skill when the user says 'review this migration', 'is this rollback plan solid', '/migration-safety', or when the orchestrator invokes the migrations role for stage-04d. The skill walks schema delta → breaking-change classification → backfill strategy → dual-write strategy → rollback plan → rollback test → gate write. Has veto power on unsafe migrations.

Plan, execute, verify, and commit a single codebase improvement. Use this skill whenever the user says things like 'implement [item]', 'work on [roadmap item]', 'fix [finding from audit]', 'plan the change for [item]', 'execute the plan', or 'verify the changes'. Also triggers on 'next item from the roadmap' or 'pick up where we left off'. This skill is for small-to-medium changes that don't need the full /pipeline. It ensures changes are planned before coded, verified after coding, and committed atomically with human approval at every step.