Product-Suite

Claim a Forge issue and then PROVE you hold the live lease before you touch it, using `forge issue owns <id>` (exit 0 iff you hold the single unexpired lease). Use this whenever winning the claim matters: right after `forge claim`, before you `dev`/edit/`close`/`release` a claimed issue, when two agents or a subagent fan-out contend for the same work, or before any irreversible step. A claim's `ok:true` does NOT prove you won — duplicate replays return it and expired leases get reclaimed; only `owns` proves it, so re-verify before close/release. Trigger on "claim this issue safely", "did I actually win the lease", "verify/prove ownership", "claim conflict", "two agents grabbed the same issue", "check I still own it before closing", or before ANY mutation of a claimed issue. NOT for plain single-issue create/update/close/comment with no ownership question (that is issue-basics), and NOT for read-only selecting or ranking the next ready issue without claiming (that is triage-ready).

Forge DEV stage — implement an already-planned /plan task list into committed, test-backed code. Reads tasks.md + plan.md, then drives each task through a subagent TDD loop (implementer → spec-compliance reviewer → code-quality reviewer) with RED-GREEN-REFACTOR, HARD-GATE evidence checks, and a spec-gap decision score. Use when a plan and task list already exist and it is time to implement — triggers: "/dev", "start the dev stage", "build the tasks", "implement tasks.md test-first", "run the implementer/reviewer TDD loop", "write the code for the planned tasks one by one", "work through the task list with subagents". Per-task coding ONLY. Do NOT use for creating the design doc or task list (that is plan), for the post-build type-check/lint/security/test gate (validate), for pushing the branch or opening the PR (ship), for addressing PR review feedback (review), or for orchestrating several stages / taking an issue end-to-end to a merged PR (smith).

Hermes⇄Forge boundary: Hermes CONSUMES Forge state, never a second source of truth. Use whenever a Hermes session runs on a Forge repo: at session start, before acting on an issue, or when you need CURRENT state. Read state ONLY via `forge orient` / `forge recap <issue-id>` (bounded JSON envelope), citing each source's `path`/`authority`; never reconstruct it from raw stores or kernel internals. Writeback ONLY via `forge comment`/`update`/`create`; NEVER leak Hermes profile or session memory into Forge state. Triggers: "orient me / current project state", "where did this fact come from, cite it", "orient came back truncated", "persist a decision into Forge", "safe to store in kernel state?". NOT the Forge session router over stage skills (kernel), NOT the human "what stage am I in" report (status), NOT everyday issue create/update/close/search CRUD (issue-basics), NOT ranking the next ready issue (triage-ready), NOT live PR monitoring (shepherd—outside Hermes, unseen by orient).

Everyday single-issue CRUD over the `forge issue` verbs: create/update/show/list/search/close/reopen/comment, set priority/labels/assignee, claim or release one issue, add/remove dependency edges, plus backlog `stats`. Use for ANY routine one-off issue op: "create an issue/bug/task for X", "update/edit issue <id>", "close or reopen this issue", "comment a handoff note on <id>", "list/filter open bugs by status/label/priority", "bump this to P1", "reassign to alice", "mark <id> blocked by <id>". Also the parity floor migrating off a Beads-style tracker (label/reopen/delete map to forge equivalents). Single-operation plumbing only. Does NOT choose, rank, or explain the next issue to work on or why it's blocked (use triage-ready); does NOT run claim-then-prove-lease-ownership safety (use claim-safety); does NOT drive an issue through the plan->dev->validate->ship pipeline or open a PR (use smith or stage skills); does NOT report the current stage or what's in flight (use status).

Forge kernel — umbrella index/router for a Forge project. Reach for this FIRST when orienting rather than executing: at session start, when you need the map of how the system fits together, or when unsure WHICH skill or `forge` verb a task belongs to. It indexes `smith` (end-to-end orchestrator), the stage ladder (plan → dev → validate → ship → review → verify), the utility/issue skills, and the day-to-day `forge` CLI verbs. Trigger on "how does the Forge workflow work", "which forge command or skill for X", "I'm new here, how is Forge set up", or "should this be a Forge issue or a TodoWrite". Index layer only — hand off the doing: rank/pick the next ready issue → `triage-ready`; current stage / "where am I" / active or stale work → `status`; create/update/close/search one issue → `issue-basics`; claim-then-prove ownership before mutating → `claim-safety`; drive one issue from plan to a merged PR under gates → `smith`; token-bounded state for the Hermes harness → `hermes-forge`.

Capture and retrieve durable project memory the right way -- and, when the graph backend is enabled, use temporal knowledge-graph memory. Reach for this whenever you are about to write down a lasting fact, decision, convention, or gotcha ("remember that...", "note for later", "save this"), or when you need to recall what was learned before ("what did we decide about X", "have we seen this"). It explains WHEN to use `forge remember` / `forge recall` versus a per-issue `forge issue comment`, how the two public backends work (local JSONL default, opt-in Graphiti; kernel is internal-only), and -- when Graphiti is enabled -- how to add episodes and search facts via the graphiti-memory MCP tools (add_memory, search_memory_facts, search_nodes) with group_id scoping and provenance. The local backend is always the offline floor. Not for: issue create/list/close ops (issue-basics), workflow status (status), or transient scratch notes.

Heavyweight EXTERNAL research reports — market, industry, competitive, strategic — via Parallel AI's paid pro/ultra processors that crawl and synthesize dozens of sources into one long cited report. Use when the user wants a market analysis, competitive landscape, industry deep-dive, multi-vendor/technology comparison, strategic recommendations, or market sizing/growth outlook — any multi-source synthesis needing more than 3-4 web searches. Typical phrasings: "market analysis of X", "competitive landscape comparing A/B/C", "industry deep-dive on...", "deep research report on...", "strategic report with predictions for 2027". WRONG tool for quick facts, a single-page fetch, one-URL scraping, or small structured-field extraction — use built-in WebSearch/WebFetch. Also NOT the Forge RESEARCH or PLAN stage: "run the research stage", "do Phase 2", or codebase/OWASP/DRY investigation into a design doc route to `research` and `plan` (they may INVOKE this skill). Requires PARALLEL_API_KEY.

Forge PLAN stage — first stop when starting a NEW or unscoped feature. Sets up an isolated worktree up front, then runs one-question-at-a-time brainstorming for design intent, commits a design doc, does technical/OWASP/DRY + codebase research, and produces a TDD task list for /dev. Trigger on "let's plan X", "scope a new feature", "brainstorm before we build", "write a design doc", "break this into tasks", or "set up a worktree and task list before coding". Reach for this even when the ask sounds like only design or only scoping — plan owns intent → research → task-list setup as one stage. NOT for driving a feature to a merged PR (that is smith), NOT for implementing tasks that already exist (dev), NOT for a standalone deep-research pass into an approved design doc (research), NOT for reporting where work stands or what is stale (status), and NOT for everyday issue create/list/close or picking the next ready issue (issue-basics / triage-ready).

Forge RESEARCH — a first-class, freely-invocable investigation skill any agent can call standalone OR mid-workflow (mid-/dev, mid-/validate, mid-/plan), not a plan-only stage. Use it to verify/fact-check a claim against primary sources; web-search best practices, gotchas, and docs; find better options/patterns and weigh trade-offs; see both sides (steelman the right way AND red-team the wrong way); pull inspiration from stronger sources; and run the /plan Phase 2 bundle (web research + OWASP Top 10 + DRY/blast-radius codebase exploration + 3+ TDD scenarios) under `## Technical Research`. Trigger on "verify/fact-check this", "research X", "find a better way/option", "is this true", "get inspiration", "run the research phase", or mid-task "investigate before I decide". Pick over siblings: `parallel-deep-research` for a heavyweight EXTERNAL market/competitive report (paid Parallel AI); `plan` for the full plan stage (brainstorm + tasks); `dev` or `validate` to implement or scan rather than investigate.

Forge REVIEW stage — drives an already-open PR to all-green by resolving EVERY piece of feedback: failing GitHub Actions / CI checks, Greptile and CodeRabbit inline comments and summaries, and the SonarCloud quality gate. It fixes the code, replies to each thread and marks it resolved until checks pass, then runs the pre-merge doc gate and hands the PR off for MANUAL merge — never runs `gh pr merge`. Use whenever a PR has review feedback or red checks: "address the review comments on PR #123", "the bots flagged issues / Greptile score is low", "fix the failing checks and resolve the threads", "CodeRabbit and SonarCloud left comments", "get my PR merge-ready". This MUTATING feedback-resolution stage is distinct from shepherd (only WATCHES an open PR, changes nothing), verify (POST-merge CI health check + closing issues), ship (pushes the branch + opens the PR), validate (PRE-PR local type/lint/test/security), and sonarcloud / sonarcloud-analysis (only QUERY SonarCloud data).

Safely revert or undo a change that is already committed or shipped, using non-destructive `git revert` (never `reset --hard`, `push --force`, or `clean`). Drives the interactive `bunx forge rollback` menu: undo the last commit, revert a commit by hash, revert a merged PR (git revert -m 1), restore individual files to a prior version, revert a commit range, or dry-run/preview first. Use when the user says roll back, revert, undo, back out, or restore — e.g. "undo the last commit", "undo that change, the approach was wrong", "back out PR #123", "revert the merge commit", "restore src/auth.js to before my last commit", or when a shipped/merged change broke something and must be pulled back. Do NOT use for: replying to or fixing PR review feedback (review), monitoring an open PR's checks toward merge (shepherd), the post-merge CI health check on master (verify), pushing a branch or opening a PR (ship), or ordinary issue status/field edits (issue-basics).

Monitor an already-reviewed OPEN pull request toward merge: read the CI/check rollup and the branch-protection required-check set, take at most one idempotent action (re-run a flaky required check, or post a status reply to a thread), then declare MERGE_READY, PENDING, or escalate. Use when the user says "is PR #123 ready to merge yet?", "poll/watch the checks on my PR", "the required CI job is flaky — kick off a re-run", "keep an eye on this PR until it's green", "babysit the checks after /review", "shepherd PR 45", or "monitor the PR toward merge (rebase if behind, --auto-rebase)". NEVER merges (the human merges in the GitHub UI), edits code, or resolves review threads. Do NOT use to fix or reply-and-resolve PR feedback from Greptile/CodeRabbit/SonarCloud — that is `review`; nor to open/push the PR — that is `ship`; nor for the post-merge "CI green on master + close issues" check — that is `verify`; nor for a general "where am I / what's in flight" report — that is `status`.

Forge SHIP stage: push the validated feature branch and open a PR populated from the project's OWN PR template (design-doc link, Forge issue IDs, real test/commit data), then hand off for MANUAL merge; never merges or auto-merges. Use once /validate passes and you want a PR on the board. Triggers: "ship it", "ship this branch", "open the PR", "push and open a PR", "gh pr create", "checks passed, now cut the PR". Runs branch-freshness + parallel-PR merge-sim checks, force-with-lease push, records the ship->review handoff, then stops. One stage only; not for: the whole plan->dev->validate->ship->review pipeline or drive-to-done (smith); type-check/lint/tests/security first (validate); addressing PR comments or resolving Greptile/SonarCloud/CodeRabbit threads on an existing PR (review); babysitting an open PR toward merge (shepherd); post-merge CI health check + closing issues (verify); reverting an already-shipped change (rollback). If the PR already exists, this is not the skill.

The flagship Forge orchestrator: given a goal or a ready issue, it composes the stage skills (triage-ready · claim-safety · plan · dev · validate · ship · review · verify) into the right path for the work, running autonomously between human gates and pausing at them. Use this whenever the user wants to work the next ready issue, drive a feature or fix end-to-end, "take this through to a PR", orchestrate the whole workflow with human checkpoints, or asks some form of "what should I work on and get it done" — even if they never say "smith" or "orchestrate". Reach for it especially when the request spans multiple stages (plan → build → ship) or asks to keep a human in the loop at intent, plan, or merge. Prefer a single stage skill only when the user explicitly wants just that one step (e.g. "just open the PR").

SonarCloud deep-dive via its REST API: pull open issues (bugs, vulnerabilities, code smells), coverage/duplication metrics, quality-gate pass/fail with failed thresholds, security hotspots, and measure/analysis history for a whole project, branch, or PR, then return a ranked summary. Use whenever the user names SonarCloud or asks about code-quality metrics, technical debt, a red/failing quality gate, or static-analysis vulnerabilities/hotspots — e.g. 'why is the SonarCloud gate failing on this PR' or 'pull every BLOCKER vulnerability with file and line'. NOT for: the thin `/sonarcloud <query> <project>` slash command for a quick lookup (sibling 'sonarcloud'); replying to/resolving PR review threads across Greptile, CodeRabbit, or GitHub Actions ('review'); running local lint/type-check/test/security scans pre-ship ('validate'); implementing or patching a flagged issue ('dev'); or an external market/competitor report on SonarSource or DevSecOps vendors ('parallel-deep-research').

Query SonarCloud code-quality data via the `/sonarcloud` slash command — the fast in-context lookup for a project, branch, or PR. Handles `issues`, `metrics`, `gate` (pass/fail + failed conditions), `health`, `pr <number>`, `hotspots`, `history`, plus `--branch`, `--severity`, `--type`, `--new-code` filters. Use the moment the user types `/sonarcloud ...` or asks in plain language: "what does SonarCloud say about this PR", "check the SonarCloud quality gate before I ship", "SonarCloud blocker/critical bugs on develop", "new-code SonarCloud issues on PR 214". Only READS/reports — does NOT fix findings or reply-to/resolve PR threads (that is `review`); it is the lightweight command surface, NOT the deep-analysis session correlating findings with local source or history trends (that is `sonarcloud-analysis`). Not for local SAST scans of your own code, nor the Forge issue tracker (`forge issue ...`, "open/ready issues") — here those bare words always mean SonarCloud.

Report where the project stands and what work is in flight -- the Forge status snapshot. Reach for this at session start or whenever the user says "/status", "where am I", "what's in progress", "catch me up", "resume work", or "what changed recently". It surfaces the workflow stage, your active/claimed issues, all issues ranked by composite score with conflict-risk flags, stale already-merged issues (which it closes), and recent commits. Use it to ORIENT and decide the next move -- it reports state; it does not plan, develop, or claim issues. Not for: routing to a stage skill or documenting the full issue-verb surface (kernel); ranking and EXPLAINING a single next-ready or blocked issue to hand off (triage-ready); everyday create/update/list/close/comment/search issue ops (issue-basics); the Hermes harness's token-bounded orient/recap contract (hermes-forge); or the post-merge CI health check that closes issues after a merge lands (verify).

Surfaces, ranks, and EXPLAINS the single best next issue in a Forge project — strictly read-only. Recomputes the live ready queue and explains what is blocked via `forge issue ready`/`blocked`/`stats`/`show`, always against the live kernel, never `forge board`. Recommends ONE issue with a one-line reason, then hands off; never claims, comments, closes, or mutates. Use when the user asks "what should I work on", "what's next", "what's ready", "pick/triage my next task", "top of the ready queue", "which issue should I start", "why is this issue blocked", or "what's blocking the most work". NOT for claiming or taking ownership of the pick (use claim-safety), not for everyday issue create/update/list/search/close/comment/dep CRUD (use issue-basics), not for reporting the current workflow stage or "where am I / what's in flight" (use status), not for orienting a whole session or routing to stage skills (use kernel), not for driving an issue to a merged PR (use smith).

Forge VALIDATE stage — the pre-pull-request quality gate. Rebases the branch onto the current base branch, then runs type-checking, linting, code review, an OWASP Top 10 security review plus dependency scan, and the full test suite, demanding fresh passing output in THIS session before anything ships. Reach for this whenever a branch is code-complete and someone says: validate my changes, run the quality gates, run the pre-PR checks, type-check and lint before the PR, run the security scan, or run the full test suite before opening a PR — and for the literal `/validate` command or `bun run check`. This is the gate that runs AFTER code is written but BEFORE a PR exists, so discriminate carefully: it does not implement features or write tests (that is `/dev`), it does not push the branch or open the PR (that is `/ship`), it does not answer PR review feedback from Greptile / SonarCloud / CodeRabbit (that is `/review`), and it is not the post-merge CI health check (that is `/verify`).

Runs the Forge verify stage — the post-merge health check performed AFTER a PR is merged: switch to master and pull, confirm the merge landed, check CI is green on master, confirm deployments are up, remove the merged worktree, safe-delete the branch, and close the kernel issues the PR resolved. Use when asked to verify a merge went cleanly, confirm post-merge CI health on master, check deployments after merging, clean up a merged branch or worktree, or close the issue now that its PR is merged — and whenever `/verify` is invoked. Strictly the POST-merge stage: use shepherd instead to monitor a still-open PR toward merge, review to fix and resolve PR feedback before merge, ship to push the branch and open the PR, rollback to undo an already-shipped change, status to merely report the current stage without acting, and issue-basics to close an issue unrelated to a just-merged PR.