0xHoneyJar

Security and quality audit of application codebase

Autonomous agent execution mode

Bridgebuilder — Autonomous PR Review

Triage a bug report through structured phases and create micro-sprint

L2 cost-budget enforcer — daily token cap with fail-closed semantics under uncertainty (billing-API primary, internal counter fallback, periodic reconciliation cron)

L5 cross-repo status reader — reads structured cross-repo state via gh API with TTL cache + stale fallback, BLOCKER extraction from NOTES.md, per-source error capture, p95 <30s for 10 repos

Design and deploy production infrastructure

Launch PRD discovery with codebase grounding and context ingestion

Single-pass network health observation. Checks API liveness, namespace freshness, drift, computes Network Health Score.

Deep investigation of a single construct. Identity-reality drift, maintenance pattern, composition analysis.

Single-pass network health observation. Checks API liveness, namespace freshness, drift, computes Network Health Score.

Autonomous observation loop. Time-boxed cycles with ratcheting health score, commits findings to grimoires.

Synthesize observations into a readable network health report. Aggregates patterns and trends from observation cycles.

Single-pass coherence sense of an ARBITRARY estate (a registry/state pair). Resolves the read-command from operator-local estate-config, shells the estate's own doctor read-only, emits exactly the STATUS|SIGNAL|MISMATCH tile. Sense-only — never mutates the estate.

Sense whether the config the OPERATOR owns is consistent across an estate of Loa repos. Loa is mounted per-repo, so every repo carries its own .loa.config.yaml and there is NO global tier — operator-owned config (model routing, which models review code, effort) gets duplicated across N repos and DRIFTS. This eye walks the estate, classifies each config key by TIER (operator vs project), and fires `drift` when an operator-tier key — one that SHOULD be identical everywhere — holds more than one distinct value. Optionally flags dead model pins against a model SoT. Emits the STATUS|SIGNAL|MISMATCH tile + a config-drift ledger. Sense-only — never mutates a config, never gates.

Sense the live CONSTRUCT estate — declared ↔ governed ↔ earned (map ↔ installed ↔ done). Replaces hardcoded construct-maps (CLAUDE.md tables, .run/construct-index.yaml, generated adapters) with a fast read-only SENSOR that walks the real packs, the composition declarations, and an earned-authority ledger. Emits the STATUS|SIGNAL|MISMATCH tile + Exhibit A + a three-row composition console. Sense-only — never grants authority, adds a gate, or mutates a pack.

Security and quality audit of application codebase

Autonomous agent execution mode

Bridgebuilder — Autonomous PR Review

Browse and install construct packs from the Loa Constructs Registry

Triage a bug report through structured phases and create micro-sprint

BUTTERFREEZONE Generation Skill

Autonomous skill extraction from debugging discoveries. Activates when agents find non-obvious solutions through investigation, experimentation, or trial-and-error. Captures these discoveries as reusable skills for future sessions.

Design and deploy production infrastructure

Capture point-in-time MER (MiDi Experience Record) for a wallet — data state, visual screenshot, perception context, and decision metadata.

Compare user expectations (UTCs) with code reality to identify gaps. Use when you need to understand discrepancies between what users expect and what code actually does.

Batch scan canvases for GAP sections, deduplicate, route to correct repos, draft issue bodies, and file confirmed issues.

Parallel multi-user processing using Claude Code native teams. Leader spawns workers per user, each runs /ingest-dm, leader aggregates for cross-canvas patterns.

Validate gap hypotheses by manually simulating features for individual users and measuring commitment, not satisfaction.

Automated end-to-end feedback pipeline that pulls new Supabase entries, enriches, classifies, routes to canvases, and generates a synthesis report.

Show what changed since last validation for a specific artifact. Computes confidence without writing to frontmatter.

Scan all artifacts for confidence metadata and report staleness using pure derived scoring.

Apply a community-input-driven trait change to a token. Updates metadata + image, re-pins, prepares the protocol-side contract call. The act-skill of the customization cluster.

Lift a collection's metadata + images off a defunct pinner (e.g. the dead mibera metadata service) onto Freeside + IPFS dual-pin. Recovery skill — the construct's first cultivation event.

Upload metadata JSON and image assets to Freeside (Honey Jar's own infra) and return immutable URIs. Vendor implementation for the primary pin under the dual-pin policy.

Pin metadata + image to IPFS via the configured pinner (Pinata, nft.storage, web3.storage, or self-hosted). Vendor implementation for the fallback pin under the dual-pin policy. Decentralized survival layer.

Rotate a collection's on-chain baseURI from a stale source (defunct pinner, sunset domain, deprecated route) to a new sound source (thj-assets CloudFront, Next.js metadata API, freshly migrated S3 prefix). Pre-flight verifies the new URI resolves end-to-end before any tx; post-flight forces marketplace re-index. Companion to migrating-storage.

Plan a time-locked operational event — mint, graft drop, harvest event — with substrate pre-flight, broadcast composition, and on-landing verification. Operational moment within a cultivating-cycle.

Recover metadata from a defunct or unreliable source (dead Irys gateway, unreachable IPFS CIDs, sunset vendor) and stage it at a new healthy endpoint ready for rotation. The data-side companion to rotating-baseURI.

Replace a token's image — composes with the-mint when regeneration is needed — re-pin both image and metadata, update the metadata's image-hash reference. Image specialization of grafting-traits.

Navigate the codex by dimension — archetype, ancestor, element, drug, era, tarot, swag rank

Security and quality audit of application codebase

Bridgebuilder — Autonomous PR Review

Create comprehensive Software Design Document based on PRD

Query Flatline protocol knowledge base via NotebookLM integration

Execute sprint tasks with production-quality code and tests

Loa onboarding wizard: environment detection, profile questionnaire, config generation, and post-config explanation in ≤10 turns

Red Team — Generative Adversarial Security Design

Creative direction for AI image generation — distill a codebase's FEEL canon (taste tokens, TDRs, persona files) into prompt-ready material vocabulary, map product architecture to scene systems, and enforce visual discipline across banner sets and scene stacks.

Analyze feedback logs to detect design preference patterns. Auto-contributes HIGH confidence patterns upstream.

Motion design and animation patterns for UI based on Emil Kowalski's principles

Touch, keyboard, and form interaction patterns for accessible UI

Design physics system for UI interactions - sync strategies, timing, confirmations

Convert vague "feel" feedback into specific actionable fixes via decomposition questions

Component design patterns - compound components, composition, props API

Interactive design direction through visual reference capture and tension resolution. Use when starting a new project or refining design direction.

Bridgebuilder — Autonomous PR Review

Triage a bug report through structured phases and create micro-sprint

Launch PRD discovery with codebase grounding and context ingestion

Execute sprint tasks with production-quality code and tests

Validate sprint implementation against acceptance criteria

Security and quality audit of application codebase

Autonomous agent execution mode

Design and deploy production infrastructure

Security and quality audit of application codebase

Bridgebuilder — Autonomous PR Review

Create comprehensive Software Design Document based on PRD

Execute sprint tasks with production-quality code and tests

Loa onboarding wizard: environment detection, profile questionnaire, config generation, and post-config explanation in ≤10 turns

Create comprehensive sprint plan based on PRD and SDD

Red Team — Generative Adversarial Security Design

Validate sprint implementation against acceptance criteria

Generate or validate UI with design physics

Slot external knowledge into Rune constructs

Validate data correctness in web3 components

Capture taste preferences for design physics

Hypothesis validation and closed-loop learning

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

UI quality enforcement skills from ibelick/ui-skills. Prevents AI-generated interface slop.

Design engineering principles and patterns for building polished, accessible web interfaces. Use this skill when building UI components, reviewing frontend code, implementing forms, handling touch interactions, optimizing performance, or creating marketing pages. Triggers on: design engineering, UI polish, input fields, form validation, button states, touch devices, mobile UX, accessibility, a11y, keyboard navigation, aria labels, font rendering, typography, layout shift, z-index, animations, transitions, easing, hover effects, tap targets, iOS Safari, prefers-reduced-motion, marketing pages, landing pages, dark mode, theme switching, scrollbars, gradients, shadows, virtualization, preloading.

Scan for PII exposure in API responses, committed files, grimoires, and data flow paths.

Scan for secret leakage in env files, client code, git history, and build artifacts.

API endpoint security surface scan — auth gates, data exposure, rate limiting, input validation.

Audit authentication flow completeness — login, refresh, logout, session, RBAC, middleware.

Map impact surface of a change or regression by tracing data flow through every consumer.

Generate defensive measure specifications from a PMR — test specs, types, error boundaries, checklists.

Create a structured Postmortem Record from an incident, mining git history and issues for timeline and blast radius.

Verify hardening measures from past PMRs still hold by checking tests, types, and error boundaries.

Decode, trace, and explain failed or complex transactions. Handles reverts, custom errors, Safe multisig payloads, multicalls, and nested calldata; explains what happened in plain language.

Ground dApp frontend assumptions in on-chain reality. Reads deployed smart contract state via `cast` and compares against hardcoded values in the frontend codebase to catch UI/contract drift.

Compare frontend ABI definitions against deployed contract reality. Finds inline ABIs, ABI files, and contract interface references; cross-checks each against on-chain state via `cast`; reports mismatches that cause silent failures or reverts.

Agent-Browser Web3 E2E testing — drives wallet flows in a real browser (or generates Playwright scripts), submits transactions against test environments only, and writes a report to grimoires/protocol/e2e-report.md.

Web3 frontend linter — scans for BigInt safety violations, wei handling errors, address checksum failures, timestamp confusion, and unsafe number coercions in dApp frontends.

Web3 test suite runner — runs the project's tests, diagnoses Web3-specific failures (BigInt, gas, reverts, nonce), audits coverage of contract interactions, and generates starter test scaffolding when missing.

Contract type verification — ensures TypeScript types in the frontend exactly match deployed smart contract ABIs by inspecting wagmi codegen, foundry/hardhat configs, and manual ABI imports.

Cross-model adversarial contract review — deep audit of every place the frontend touches contracts (parameter mismatches, error handling gaps, gas estimation, optimistic update races, BigInt safety) in Bridgebuilder format, written to grimoires/protocol/contract-review.md.