medcore

Publish a GitHub release for MedCore from current main — stamps CHANGELOG.md [Unreleased] as the new version, creates an annotated tag at HEAD, pushes both, and creates the GitHub release with the stamped CHANGELOG section as the release body. Use when the user says "cut a release", "publish v1.X.Y", "tag this", or "make this an actual GitHub release I can roll out". Reads recent commits to suggest the version bump (minor by default; major if breaking changes), validates the release.yml status before tagging, and produces a fully-published release (not draft) by default. Codified from the 2026-05-07 v1.3.0 cut.

Process the open human-PR backlog (NOT dependabot — that's a separate skill) using the mergeability × check-state matrix to classify each PR into close / comment / rebase / merge. Use when the user says "check the open PRs", "merge what we can", "clear the PR queue", or there are 3+ open PRs sitting on the queue. Codified from the 2026-05-07 wave (6 open PRs → triaged to 0; 3 closed as superseded/major-bump, 1 rebased, 2 merged green, 1 commented for first-time-contributor workflow approval). Companion to /medcore-dependabot-triage.

Process the open dependabot PR backlog as a wave — auto-merge the patch+minor PRs that land green, leave the breaking-major PRs open with a clear note, distinguish stale CI failures from real ones, and unblock the workspace's known peer-dep ERESOLVE class via a root .npmrc. Use when the user says "look at the dependabot PRs", "merge what we can", "clear the dep backlog", or there are 3+ open `app/dependabot` PRs sitting on the queue. Codified from the 2026-05-05 evening wave (8 dependabot PRs triaged;

Add the canonical AI_<FEATURE>_INFERENCE audit row + (where applicable) sanitizeUserInput prompt-injection guard to a new or existing AI route under apps/api/src/routes/ai-*.ts. Use when adding a new AI feature, when an audit finding flags a missing inference row, or when a new free-text field is plumbed into an LLM prompt. Pairs with /medcore-route-test for the test surface and /medcore-fanout when retrofitting several AI routes in parallel.

Dispatch the MedCore release.yml validation workflow on origin/main, watch the run to completion, and on failure surface the exact failing tests + the first ~100 log lines so the next investigation step is obvious. Use when the user says "kick off release.yml", "validate this push", "run the e2e suite", "release-validate", "check if WebKit holds", or wants the full Playwright + integration suite to run on the current SHA. Replaces the manual `gh workflow run` + `gh run view` + `--log-failed | grep` ritual.

Diagnose a failing per-push Test workflow run by pulling assertion-level details, grouping failures by symptom, classifying each cluster (stale contract / cred mismatch / cascade poisoning / strip-vs-reject / pre-existing), and surfacing the root cause that's poisoning others. Use when CI Test on main goes red with multiple failures across files, when a per-push run fails after a wave of API/handler changes, or when "the suite was green yesterday and now N tests fail" without a single obvious cause. Companion to /medcore-release (which covers the heavier release.yml E2E gate).

For a single Express route file under apps/api/src/routes/, verify each /:id-shaped handler against the cross-patient access (BOLA / IDOR / OWASP API1:2023) checklist and either patch the gap with assertPatientOwnsResource OR document the verified-safe verdict inline. Pairs with /medcore-fanout (one agent per route file) when closing batches of Issue

Scaffold a new Playwright e2e spec for a MedCore dashboard route, following the descriptive-headers convention and the existing fixtures/helpers contract. Use when the user asks to "write an e2e for /dashboard/X", "close the backlog entry for /Y", or "add Playwright coverage for Z". Produces a complete `e2e/<route>.spec.ts` plus the closure annotation in docs/E2E_COVERAGE_BACKLOG.md, validated via `playwright test --list`. Pair with /medcore-fanout to close 3-4 backlog routes in parallel.

Scaffold a Vitest unit test for an Express route handler at apps/api/src/routes/<x>.ts — RBAC matrix, Zod validation rejections, happy paths, audit-log assertions, all with hoisted Prisma mocks (no real DB). Use when the user asks to "write a unit test for /api/v1/<resource>", "cover route <x>", or "close the test gap for this handler". Pairs with /medcore-fanout when closing several route test gaps in parallel. Companion to /medcore-e2e-spec for full-stack route coverage.

Dispatch multiple parallel foreground Agent calls to close non-overlapping MedCore gaps in one shot — closing several E2E backlog routes at once, writing several test files at once, fixing several bugs at once, or any "do these N things in parallel" request. Use when the user wants concurrent work on tasks that touch different files / directories. Do NOT use for sequential dependencies, single-task work, or tasks that need bg dispatch (this skill exists specifically because bg agents are broken on this VSCode harness build).

Roll forward MedCore docs (TODO.md banner + "What landed" section, CHANGELOG.md [Unreleased], optional new SESSION_SNAPSHOT) so nothing is lost between waves of /medcore-fanout work. Reads recent commits + their bodies (which carry agent findings), categorizes them into doc destinations, deduplicates against existing entries, and pushes one consolidated docs commit. Idempotent — safe to run multiple times. Use after any /medcore-fanout wave, after any 3+ commit batch, or at end-of-session as a checkpoint.