TGPSKI

Manage the full Go module release lifecycle: determine next semver version, update CHANGELOG.md, create and push a git tag, and verify pkg.go.dev picks up the new version. Use when the user asks to tag a release, bump the version, update the changelog, or publish a new module version.

Audit and optimize CLI flag definitions across all skeptic subcommands. Reviews help text quality, global-vs-local flag modeling, short flag coverage, shorthand config-precedence safety, help formatter consistency, and test isolation. Use when adding flags, reviewing CLI ergonomics, refactoring subcommand interfaces, or debugging flag override behavior.

Audit a document against the codebase for accuracy, then tighten it: verify claims, cut drift, simplify, restructure for the reader. Use when the user says a doc is loose, stale, or wrong, or asks to tighten/audit a README, guide, config reference, or any prose that makes claims about code.

Generate, update, and maintain per-module documentation under docs/modules/, keep ARCHITECTURE.md and README.md current, and produce Mermaid diagrams for data-flow, block, and dependency views. Use when the user asks to document a package, update architecture docs, generate diagrams, or audit documentation freshness.

Add or update rule definitions, create and manage rule groups, and migrate rules across groups in skeptic using the property-based layout. Use when the user asks to add/update rules, add/manage groups, or reorganize `internal/rules`.

Ingest fresh security research from URLs/files, generate signed scanner rule packs, and validate with policy and behavior scan styles across ecosystems. Use when the user asks to operationalize new threat intel into skeptic detections.

Audit and update GitHub Actions workflow files to use the latest action releases pinned to full commit SHAs. Scans all .github/workflows/*.yml files, resolves current vs latest versions, and applies upgrades. Use when the user asks to update actions, check for outdated workflow dependencies, pin actions to SHAs, or audit CI workflow hygiene.

Prepare a leather release: auto-detect next version from git history, insert CHANGELOG section, update docs, commit and push. USE FOR: cutting a new release; bumping version after feature or fix work. DO NOT USE FOR: tagging the release (use release-tag after this skill completes).

Manage AGENTS.md and .subagents/*.md across the leather subagent guide set (currently 17 guides spanning core, runtime, worker, serve, tannery, quality, performance, security, operations, shell-mcp, ui, replay, agent-definition, tools/skills/toolsets semantics, integrations, examples, and observability). USE FOR: auditing every guide against the codebase; adding routing-table rows for new packages or features; splitting an overloaded guide; merging thin guides; updating flag/type/subcommand tables; validating cross-references and ownership uniqueness; enforcing the per-guide `last reviewed` footer; running the full ownership/footer/cross-ref health check. DO NOT USE FOR: writing implementation code; debugging runtime errors; running tests.

Generate, update, and maintain per-module documentation under docs/modules/, keep docs/ARCHITECTURE.md and README.md current, and produce Mermaid diagrams for data-flow, block, and dependency views. USE FOR: documenting a package; updating architecture docs after structural changes; generating diagrams; auditing documentation freshness; first-time doc generation for the project. DO NOT USE FOR: writing implementation code; debugging runtime errors; updating AGENTS.md or .subagents/ guides (use agents-doc-lifecycle instead).

Tag a prepared leather release and push the tag to origin. Triggers the automated release pipeline. USE FOR: after release-prep has committed and pushed. DO NOT USE FOR: preparing the CHANGELOG or docs (use release-prep first); creating GitHub releases directly (the pipeline handles that).

Audit and improve test coverage, formatting, linting, and test organization for the leather codebase. USE FOR: finding untested exported functions; identifying test files that should be split; checking and fixing gofmt/golangci-lint issues; producing a coverage gap report; catching benchmark regressions; full quality gate pre-PR. DO NOT USE FOR: writing business logic; documentation (use documentation-lifecycle); agents doc sync (use agents-doc-lifecycle).

Structured diagnostic reasoning for AI agents investigating incidents, failures, and unexpected behavior. Teaches agents to resolve coordinate mismatches first (majority of incidents), then build timelines, generate competing hypotheses, identify discriminating evidence, and produce portable investigation artifacts. Use when asked to create a triage workflow, investigate an incident, debug a failure, or encode a diagnostic process.

Investigate a system that appears to work but silently fails under specific conditions. Demonstrates Tier 2 investigation with the 'no hypotheses survive' recovery pattern and hidden mechanism discovery.

Investigate potential supply chain compromise indicators. Demonstrates Tier 2 investigation with multi-finding triage, timeline construction across systems, and evidence hierarchy in practice.

Investigate reported secret mismatches between a cluster and a secret store. Demonstrates Tier 1 resolution — coordinate mismatch identified and resolved without deep analysis.

Multi-phase investigation for {problem class}. Routes to the appropriate phase based on artifact state. Phase 1 resolves coordinate mismatches (majority of incidents). Phase 2 investigates systemic issues. Phase 3 remediates and documents.

Creates directed workflow files for any repository. Generates structured markdown that AI agents execute interactively to guide users through multi-step configuration processes like service onboarding, environment setup, and infrastructure provisioning. Use when asked to create a directed workflow, encode a process, or build an agent-guided configuration flow.

Add a new host or host group to an Ansible-managed infrastructure repo. Detects current progress and routes to the appropriate phase.

Grant access to a new contributor. Detects current progress and routes to the appropriate phase.

Onboard a new service to a Kubernetes platform. Detects current onboarding progress and routes to the appropriate phase.

Provision a new AWS account in a Terraform-managed infrastructure repo. Detects current progress and routes to the appropriate phase.

Runs a FIPS 140-3 crypto compliance audit across Go repositories, classifying every crypto/ import by risk and generating per-component reports. Separates first-party code from vendored dependencies and flags non-cryptographic uses of crypto primitives that break under GODEBUG=fips140=only. Use when auditing Go services for FIPS compliance, assessing new repos before adding them to FIPS CI, re-running an audit after vendor bumps, or generating evidence for compliance documentation.

Classifies an individual FIPS crypto audit finding as real cryptography or a non-cryptographic use of a crypto primitive, using structured diagnostic reasoning. Follows the abductive triage methodology of resolving coordinate mismatches first, since most findings are non-crypto, then tracing data flow and protocol requirements only when a usage is genuinely ambiguous. Use when an audit surfaces a CRITICAL or WARNING finding that needs classification, when a vendored dependency's crypto usage may not ship in the binary, or when producing evidence for a compliance review.

Generates component-specific FIPS remediation TODO lists from crypto audit results, with effort estimates and suggested PR sequencing. A directed workflow following the Inspect-Decide-Generate pattern, splitting findings into must-fix, primitive swaps, no-change-needed, and upstream dependencies. Use after a FIPS crypto audit when a component team asks what they need to fix, when planning sprint work for a FIPS migration, or when writing remediation PR descriptions.

Generate bounded codebase ownership contexts that agents can load inline or spawn in isolation. Analyzes a repository, proposes ownership boundaries, and produces a root AGENTS.md router plus .subagents/ context modules with executable validation. Use when asked to create directed contexts, split a large AGENTS.md, set up subagent contexts, add an agent routing table, or audit an existing context set.

Audit and maintain this repository's directed contexts: run validation, detect drift between the codebase and the context set, and apply split/merge/re-review fixes. Use when asked to audit agent contexts, fix context drift, update AGENTS.md routing, or after adding/removing a package.

Create, configure, and troubleshoot olwb's benefits features: destinations (/dest), sending (/send), and the notes → agent-work issues pipeline (/issues). USE FOR: adding or wiring a destination or agent preset; diagnosing stale CLI sessions, missing inbox responses, tui terminal problems, or rejected issue drafts; setting up the issues pipeline for a target repo. DO NOT USE FOR: core capture/liner/session usage (see README.md) or modifying olwb's Lua source.

Finds the maximum safe --max-model-len and --max-num-batched-tokens for a vLLM-served model on a fixed GPU, by climbing a doubling ladder one clean reboot at a time and recording the real KV-cache/concurrency signal from each boot rather than guessing. Use when asked to find max context, tune context length, or push a model to its context ceiling.

Generate or update a .security-context.yaml file for any repository. Runs a deterministic Go scan to detect security properties from repo files, interviews the practitioner for context scanners can't infer, and produces a validated file. Use when someone wants to create a security context file, add scanner context, or update an existing .security-context.yaml.