orbit-ui-mobile

Deep code review of a diff across both Orbit repos against one shared rubric, orchestrating the five review subagents and a backward-compat guard. Use when the user asks to review a PR, file, folder, or staged changes in orbit-ui-mobile or orbit-api. Replaces /review and /security-review.

Get an independent cross-model second opinion (GLM-5.2 via opencode) on a specific, load-bearing technical claim or a Critical code-review finding — a different model reads the claim + code and returns AGREE / DISAGREE / UNSURE. Use to stress-test a single Critical finding, a risky assertion, or a close call before you commit to it. Auto-fired inside /pr-review on each Critical finding that survives the skeptic. Not for open-ended research (use /deep-research) or multi-lens judgement (use /llm-council).

Break a PRD into GitHub issues across orbit-ui-mobile + orbit-api

Answer an open-ended "what's the best way to…?" question with orchestrated multi-agent deep web research. Decompose the question, fan out narrow research subagents in parallel, verify the load-bearing claims adversarially, iterate to saturation, then synthesize ONE opinionated, source-backed, decision-ready recommendation. Orbit-aware (dual-repo stack, solo-dev cost calibration). Use for technology/vendor choices, architecture & tooling decisions, cost comparisons, migration approaches, or best-practice questions — anything whose answer needs current external evidence beyond the codebase. Not for code edits, single-fact lookups, or questions answerable from the repo alone.

Create implementation plan with cross-repo codebase analysis

Prime agent with Orbit project context (both repos + optional GitHub issue)

Repo-wide code-quality audit across both Orbit repos against the same rubric /pr-review uses. Reports dead/stale code, SOLID/clean-arch violations, comment-policy breaks, DRY, naming, function size, and DESIGN.md drift — each finding evidence-backed with file:line. Use when the user asks to audit code quality, find tech debt, or check the codebase against the standards. Not for a single diff (use /pr-review).

Performance-risk audit across both Orbit repos. API — N+1 queries, missing indexes, synchronous slow work in request paths. Frontend — bundle bloat, render thrash, over-eager or stale caching. Each finding carries file:line evidence and a remediation, calibrated to Orbit's solo-dev scale. Use when the user asks to audit performance, find slowdowns, or check for scaling risks. Not for running benchmarks.

Repo-wide security audit across both Orbit repos (orbit-ui-mobile + orbit-api). Checks authz / data-isolation (incl. AI & MCP tool scoping), injection, secrets, CORS, rate-limit coverage, AI-abuse, and error leakage. Each finding carries severity, file:line evidence, threat model, and remediation, calibrated to Tier 1+2 (Tier 3 marked out-of-scope). Self-contained — runs in CI. Use when the user asks for a security audit, threat review, or pre-launch hardening pass.

Test-suite QUALITY audit across both Orbit repos — not coverage percentage. Reports critical-path coverage (auth, billing, AI tools), happy-path-only / rubber-stamp detection, and missing edge/failure cases against an "intelligent test" rubric (behavior + edge + failure), then suggests concrete missing tests. Use when the user asks to audit tests, check test quality, or find untested critical paths. Not for running tests (use /validate).

Root-cause a production incident end to end — pull the Sentry issue, correlate it to a Render deploy and its runtime logs, inspect the Postgres rows it implicates, localize the fault to code via csharp-lsp, then propose the minimal fix behind a human gate. Use when a production error, crash, Sentry alert, or "why is X broken in prod" needs diagnosing. Not for a local dev bug you already have a reproducible stack trace for — just read the code.

Pre-launch orchestrator — runs the four repo-wide audits (security, tests, performance, code-quality) in parallel via the audit workflow and adds an ops-layer audit (observability, multi-instance readiness, background durability, backups, staging), then consolidates everything into ONE tier-tagged, verification-protocol-backed report with an honest launch verdict. Use before a release to know what's safe to ship. Orchestrates + consolidates; it does not re-derive the child audits' findings.

Execute a plan across orbit-ui-mobile + orbit-api with validation loops

Compact the current session into a handoff document a fresh agent can resume from. Use when the context is getting long, you are switching tasks, or you want to end a session and continue clean without losing the thread.

Capture a mistake or correction as a reviewed, graduating lesson so it never repeats. Use when I correct you, when you catch yourself repeating a mistake, or when I say "remember this / don't do that again".

Bring up the full Orbit local stack for manual/visual testing — Docker Postgres, then the orbit-api .NET backend, then the web dev server — in dependency order with readiness gates. Use when the user wants to run the app locally, start the dev server, spin up the local stack, or view web changes in a browser.

Orchestrate one or more issues from number to PR by chaining the existing pipeline — /prime (context load only) → grill-me → /plan → [HARD GATE: user approves the plan] → /implement — with a blocking confirmation gate at every stage boundary. Nothing auto-advances; nothing implements without explicit approval. One issue runs in the main session; 2+ issues fan the same gated loop out across paired worktrees, like /prime, /plan, and /implement. Use when the user wants to take issues end-to-end with checkpoints they control.

Build the Android APK for the mobile app by running npm run android:apk. Use when the user asks to generate, build, or produce an Android APK / release / install file for apps/mobile.

An extremely strict, BEHAVIOR-PRESERVING whole-repo structural refactor pass across one or both Orbit repos — split giant files, flatten spaghetti conditionals, deepen thin abstractions, dedup cross-app logic into packages/shared, move logic to its canonical layer — under hard build/test/EF-model gates, delivered as one PR per repo with an Applied table + a complete Deferred ledger. Use ONLY when the user explicitly asks for a thermo-nuclear / nuclear / deep structural-quality pass. This rewrites code; it is not the read-only /audit-code-quality.

Monthly cross-repo non-security dependency freshness sweep. Bumps apps/web + packages/shared npm minor/patch (the only surfaces with no version automation), defers apps/mobile entirely to Expo's own tooling (never generic-bumps SDK-pinned packages), and reports orbit-api NuGet drift (Dependabot owns the bumps there). Runs the affected test suites and opens one PR. Use when the monthly "Dependency sweep" reminder issue fires, or when the user asks to refresh dependencies. NOT for security patches (Dependabot security updates auto-flow) and NOT for Expo SDK upgrades (use the upgrading-expo skill).

Vet a decision through a panel of independent perspectives, then synthesize ONE recommendation. Generates N distinct framings of a topic (each from a different lens), peer-reviews them against each other, and a chairman pass commits to a single decision-oriented call with the tradeoffs and dissent surfaced. Use when the user wants to stress-test an idea, weigh options, or get a balanced verdict on a design/architecture/product decision. Not for web-research questions (use /deep-research) or code edits.

Create a comprehensive Product Requirements Document from conversation context

Idea → PRD → stories, gated. Chains /create-prd (or /prd-interactive on a cold start) and /create-stories, with a hard confirmation gate before stories and the existing /create-stories gate before issues. Use when the user wants to turn a rough idea into well-formed GitHub issues end to end.

Interactive PRD generator - asks questions to build a PRD

Run lint, type-check, tests across both repos (auto-detects which to run)