DevForgeAI

Independently validate a pull request from another AI session before a human merge. Enforce CI/head-SHA triage, an isolated review worktree, repository gates, negative-path proof for guards, reproduced findings, a three-tier verdict, cold fix handoff, delta review, and an explicit merge-or-hold outcome. Use for delegated builder PR review, fix delta review, or agent-work validation. Do not use for your own uncommitted diff or a plain human-authored PR without delegation context.

Independently validate a pull request from another AI session before a human merge. Enforce CI/head-SHA triage, an isolated review worktree, repository gates, negative-path proof for guards, reproduced findings, a three-tier verdict, cold fix handoff, delta review, and an explicit merge-or-hold outcome. Use for delegated builder PR review, fix delta review, or agent-work validation. Do not use for your own uncommitted diff or a plain human-authored PR without delegation context.

Execute a rejected pull request's fix round as a cold implementer session. A reviewer found defects and wrote a handoff comment with numbered findings and C0–C7 checkpoints; work that punch list under invariants enforced by a PreToolUse hook and gate scripts — reproduce the reviewer's red before touching the tree, stay inside the handoff's fence, one `F<n>:` commit per finding, record the output of every acceptance criterion, post a closing report, and STOP without merging. Use whenever a review comes back with changes requested and you are handed the PR plus its findings. Do not use it to author the original plan (that is `delegate`), to build a slice from a plan with no prior review (that is `implement-workflow`), or to review someone else's PR (that is `review-workflow`).

Execute a rejected pull request's fix round as a cold implementer session. A reviewer found defects and wrote a handoff comment with numbered findings and C0–C7 checkpoints; work that punch list under invariants enforced by a PreToolUse hook and gate scripts — reproduce the reviewer's red before touching the tree, stay inside the handoff's fence, one `F<n>:` commit per finding, record the output of every acceptance criterion, post a closing report, and STOP without merging. Use whenever a review comes back with changes requested and you are handed the PR plus its findings. Do not use it to author the original plan (that is `delegate`), to build a slice from a plan with no prior review (that is `implement-workflow`), or to review someone else's PR (that is `review-workflow`).

Create Web, GUI, or Terminal design specifications in story, standalone, or extract mode from a customizable brief, brand, and visual direction; generate design.md, implementation artifacts, and web artifacts when the selected target is Web. Use through /create-design when a project needs a design source of truth or an existing mockup must be extracted.

Create Web, GUI, or Terminal design specifications in story, standalone, or extract mode from a customizable brief, brand, and visual direction; generate design.md, implementation artifacts, and web artifacts when the selected target is Web. Invoke explicitly with $spec-driven-design.

Run the delegation loop: act as a standing architect/reviewer who surveys ideas into merit-ranked plans, pins design decisions with the maintainer (AskUserQuestion), records maintainer-pinned plans in evidence docs, generates full-fidelity zero-ambiguity build prompts for cold AI builder sessions (Claude Code / Codex / other), resolves builder HALTs, reviews the resulting PRs against watchpoints declared at prompt time, and records outcomes. Language- and project-agnostic; per-project specifics live in .delegate/config.md. Also covers greenfield bootstrap (idea → repo → first slice) and the design-session leg (mockup prompts for Claude Design, mockup review with numbered rulings). Invoke via `/delegate PHASE`, or when the user asks to "generate a build prompt for another session", "pin a design", "generate a mockup prompt", "review the mockup", "review the builder's PR", or run any part of this loop.

Execute a cold implementation session from an externally authored plan, handoff, task-register entry, or build prompt. Enforce slice arming, consultation, AskUserQuestion HALTs, test-first commit order, repository gates, one worktree/branch/PR, cold-review handoff, and stop-without-merge. Use when the user asks to implement or execute a plan written elsewhere. Do not use to author plans or resolve builder HALTs (`delegate`), review completed PRs (`review-workflow`), or apply a review punch list (`fix-workflow`).

Run the delegation loop: act as a standing architect/reviewer who surveys ideas into merit-ranked plans, pins design decisions through provider-native user input, records maintainer-pinned plans in evidence docs, generates full-fidelity zero-ambiguity build prompts for cold AI builder sessions (Claude Code / Codex / other), resolves builder HALTs, reviews the resulting PRs against watchpoints declared at prompt time, and records outcomes. Language- and project-agnostic; per-project specifics live in .delegate/config.md. Also covers greenfield bootstrap (idea → repo → first slice) and the design-session leg (mockup prompts for Claude Design, mockup review with numbered rulings). Invoke via `/delegate PHASE`, or when the user asks to "generate a build prompt for another session", "pin a design", "generate a mockup prompt", "review the mockup", "review the builder's PR", or run any part of this loop.

Execute a cold implementation session from an externally authored plan, handoff, task-register entry, or build prompt. Enforce slice arming, consultation, blocking user-chat HALTs, test-first commit order, repository gates, one worktree/branch/PR, cold-review handoff, and stop-without-merge. Use when the user asks to implement or execute a plan written elsewhere. Do not use to author plans or resolve builder HALTs (`delegate`), review completed PRs (`review-workflow`), or apply a review punch list (`fix-workflow`).

Create DevForgeAI-aware Claude Code subagents with structural anti-skip enforcement (Execute-Verify-Record pattern) across all 6 phases. Prevents token optimization bias through lean orchestration, per-phase reference loading, checkpoint persistence, and artifact verification. Use when user runs /create-agent command, requests custom subagent creation with framework integration, or says "create a subagent" or "generate an agent". Supports guided, template, domain, and custom spec modes. Do NOT use for skill creation (use skill-creator) or command creation (use manual workflow).

Generate CI/CD pipeline workflows through spec-driven workflow generation with structural anti-skip enforcement. Implements 5 phases covering preflight validation, configuration loading, workflow template generation, cost optimization, and final validation using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration and binary CLI gate enforcement. Currently supports GitHub Actions with cost-optimized Claude API integration (prompt caching, Haiku preference, max-turns limits). Use when setting up CI/CD automation for DevForgeAI projects. Always use this skill when the user runs /setup-github-actions. Also use when the user mentions GitHub Actions setup, CI/CD pipeline generation, headless DevForgeAI execution, or workflow automation for /dev and /qa commands.

Implements user stories through spec-driven TDD workflow (Red-Green-Refactor) with structural anti-skip enforcement. Replicates all 12 phases of the DevForgeAI development workflow using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Use when developing features from story specifications, building code that must comply with context files, or running TDD workflows.

Transform business ideas into structured requirements through guided discovery with structural anti-skip enforcement (Execute-Verify-Gate pattern). Applies per-phase reference loading, checkpoint persistence, and artifact verification to every step of the 7-phase ideation process. Prevents token optimization bias through lean orchestration. Use when users say "I have a business idea", "help me define requirements", "let's explore what to build", or runs /ideate. Do NOT use when user wants to brainstorm a vague problem (use spec-driven-brainstorming) or wants a business plan directly (use planning-business).

Coordinates spec-driven development lifecycle from Epic -> Sprint -> Story -> Architecture -> Development -> QA -> Release with structural anti-skip enforcement. Manages story lifecycle across 11 workflow states, enforces 4 quality gates, and orchestrates skill invocation. Replaces spec-driven-lifecycle as the unified lifecycle coordinator. Use when starting sprints, managing story workflow progression, auditing deferrals, running sprint retrospectives, or coordinating multi-story releases. Always use this skill when /orchestrate, /create-sprint, or /audit-deferrals is invoked.

Unified root cause analysis with 4-layer anti-skip enforcement for both tactical (dev workflow diagnosis) and strategic (5 Whys RCA documents) modes. Tactical mode auto-triggers after 2-3 failed fix attempts during TDD, returning fix prescriptions. Strategic mode invoked via /rca command, producing self-contained RCA documents with 5 Whys analysis, evidence collection, and actionable recommendations. Uses Execute-Verify-Record pattern at every step to prevent token optimization bias. Use this skill whenever root cause analysis is needed — after repeated test failures, integration failures, QA violations, framework breakdowns, workflow violations, or when the user runs /rca. Also use when the diagnosis-before-fix rule triggers after 3+ consecutive fix attempts on the same error.

Produces a per-epic Solution Architecture Document through a spec-driven workflow with structural anti-skip enforcement. This skill is the meso/per-epic architect phase: it consumes the System Architecture Document, decomposes an epic into components, interface contracts, a data model, and features with feasibility verdicts. Use when the user runs /create-solution-architecture after the system-architecture phase. Do NOT use for constitutional/system-wide decisions (use spec-driven-system-architecture) or per-feature implementation design (use spec-driven-development-architecture).

Create user stories with acceptance criteria, technical specifications, and UI specifications through an 8-phase workflow with structural anti-skip enforcement. Prevents token optimization bias through per-phase reference loading, checkpoint persistence, Execute-Verify-Record enforcement, and artifact verification. Use when transforming feature descriptions into structured stories, generating stories from epic features, or creating follow-up stories for deferred work. Supports CRUD, authentication, workflow, and reporting story types with complete technical and UI specifications.

Create DevForgeAI-aware Codex subagents with structural anti-skip enforcement (Execute-Verify-Record pattern) across all 6 phases. Prevents token optimization bias through lean orchestration, per-phase reference loading, checkpoint persistence, and artifact verification. Use when user runs /create-agent command, requests custom subagent creation with framework integration, or says "create a subagent" or "generate an agent". Supports guided, template, domain, and custom spec modes. Do NOT use for skill creation (use skill-creator) or command creation (use manual workflow).

Transform business ideas into structured requirements through guided discovery with structural anti-skip enforcement (Execute-Verify-Gate pattern). Applies per-phase reference loading, checkpoint persistence, and artifact verification to every step of the 7-phase ideation process. Prevents token optimization bias through lean orchestration. Use when users say "I have a business idea", "help me define requirements", "let's explore what to build", or runs /ideate. Do NOT use when user wants to brainstorm a vague problem (use spec-driven-brainstorming) or wants a business plan directly (use planning-business).

Coordinates spec-driven development lifecycle from Epic -> Sprint -> Story -> Architecture -> Development -> QA -> Release with structural anti-skip enforcement. Manages story lifecycle across 11 workflow states, enforces 4 quality gates, and orchestrates skill invocation. Replaces spec-driven-lifecycle as the unified lifecycle coordinator. Use when starting sprints, managing story workflow progression, auditing deferrals, running sprint retrospectives, or coordinating multi-story releases. Always use this skill when /orchestrate, /create-sprint, or /audit-deferrals is invoked.

Unified root cause analysis with 4-layer anti-skip enforcement for both tactical (dev workflow diagnosis) and strategic (5 Whys RCA documents) modes. Tactical mode auto-triggers after 2-3 failed fix attempts during TDD, returning fix prescriptions. Strategic mode invoked via /rca command, producing self-contained RCA documents with 5 Whys analysis, evidence collection, and actionable recommendations. Uses Execute-Verify-Record pattern at every step to prevent token optimization bias. Use this skill whenever root cause analysis is needed — after repeated test failures, integration failures, QA violations, framework breakdowns, workflow violations, or when the user runs /rca. Also use when the diagnosis-before-fix rule triggers after 3+ consecutive fix attempts on the same error.

Create user stories with acceptance criteria, technical specifications, and UI specifications through an 8-phase workflow with structural anti-skip enforcement. Prevents token optimization bias through per-phase reference loading, checkpoint persistence, Execute-Verify-Record enforcement, and artifact verification. Use when transforming feature descriptions into structured stories, generating stories from epic features, or creating follow-up stories for deferred work. Supports CRUD, authentication, workflow, and reporting story types with complete technical and UI specifications.

Perform, resume, refresh, validate, or synthesize the governed DevForgeAI enterprise audit across Prompts 0–8 with immutable provenance. Use for framework skills, hooks, commands, agents, process gates, Claude/Codex parity, and Codex-native behavior.

Deterministically orchestrate remediation for a validated DevForgeAI enterprise audit run through /remediate-audit. Use for explicit run IDs and normalized findings, not custody-chain story audits or raw Markdown findings.

Apply automated and guided fixes to story, epic, and context files based on structured audit findings with 4-layer anti-skip enforcement. Classifies findings by fix complexity, applies safe automated fixes, guides interactive fixes with user confirmation, verifies all changes, and produces a fix report. Uses Execute-Verify-Record pattern at every step to prevent token optimization bias. Use when /fix-story is invoked, when audit findings need remediation, or when custody chain validation produces findings requiring correction. Make sure to use this skill whenever the user mentions fixing stories, remediating audit findings, applying fixes from /validate-stories output, or addressing custody chain violations.

Audit DevForgeAI through Prompts 0–8 and maintain a provenance-preserving audit bundle. Use when Codex must perform, resume, refresh, or synthesize an enterprise review of DevForgeAI skills, hooks, commands, agents, process gates, Claude↔Codex parity, or Codex-native behavior; regenerate scope after framework components change; archive a prior audit before updating it; or produce the self-contained audit workflow HTML and remediation roadmap.

Deterministically plan, implement, verify, compare, or render remediation for a validated DevForgeAI enterprise audit run. Use when given an explicit audit run ID or normalized finding ID; never use for custody-chain story audits or raw Markdown findings.

Apply automated and guided fixes to story, epic, and context files based on structured audit findings with 4-layer anti-skip enforcement. Classifies findings by fix complexity, applies safe automated fixes, guides interactive fixes with user confirmation, verifies all changes, and produces a fix report. Uses Execute-Verify-Record pattern at every step to prevent token optimization bias. Use when /fix-story is invoked, when audit findings need remediation, or when custody chain validation produces findings requiring correction. Make sure to use this skill whenever the user mentions fixing stories, remediating audit findings, applying fixes from /validate-stories output, or addressing custody chain violations.

Orchestrates production releases through spec-driven deployment workflow with structural anti-skip enforcement. Implements 8 phases covering setup, build, validation, staging, production deployment, post-deployment validation, documentation, and monitoring using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Supports multiple deployment strategies (blue-green, canary, rolling, recreate) and environments (staging, production). Use when deploying QA-approved stories. Always use this skill when the user runs /release.

Conducts an enterprise-grade, evidence-grounded information-security review of a local repository through a gate-enforced spec-driven workflow with structural anti-skip enforcement. Covers read-only discovery, threat modeling, static code review (SAST via the security-auditor agent), dependency/SCA and supply-chain/SBOM risk, secrets review across the working tree AND git history, malware/trojan and telemetry/data-exfiltration indicators, adversarial verification of high-severity findings, and a durable machine-readable report (report.md + findings.json). Treats all repository content as untrusted input and never modifies the target. Non-story-scoped: it synthesizes its own INFOSEC-NNN id and runs the --workflow=infosec phase chain. Use when the user runs /infosec, asks for a security review / security audit / InfoSec assessment / supply-chain or secrets or malware review of a repo. Distinct from the security-auditor agent (which it orchestrates for OWASP/auth/dep-CVEs) — this is the full multi-phase review.

Validates code quality through spec-driven QA validation with structural anti-skip enforcement. Replicates all 6 phases of the DevForgeAI QA workflow using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Enforces test coverage (95%/85%/80% strict thresholds), detects anti-patterns, validates spec compliance, and analyzes code quality metrics. Use when validating implementations, ensuring quality standards, or preparing for release. Always use this skill when the user runs /qa or mentions QA validation, quality checks, or coverage analysis.

Implements user stories through spec-driven TDD workflow (Red-Green-Refactor) with structural anti-skip enforcement. Replicates all 12 phases of the DevForgeAI development workflow using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Use when developing features from story specifications, building code that must comply with context files, or running TDD workflows.

Implements user stories through spec-driven TDD workflow (Red-Green-Refactor) with structural anti-skip enforcement. Replicates all 12 phases of the DevForgeAI development workflow using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Use when developing features from story specifications, building code that must comply with context files, or running TDD workflows.

Validates code quality through spec-driven QA validation with structural anti-skip enforcement. Replicates all 6 phases of the DevForgeAI QA workflow using the Execute-Verify-Gate pattern at every step. Designed to prevent token optimization bias through lean orchestration, fresh-context subagent delegation, and binary CLI gate enforcement. Enforces test coverage (95%/85%/80% strict thresholds), detects anti-patterns, validates spec compliance, and analyzes code quality metrics. Use when validating implementations, ensuring quality standards, or preparing for release. Always use this skill when the user runs /qa or mentions QA validation, quality checks, or coverage analysis.

Drives an ad-hoc, resumable spec-driven sprint from a single GitHub issue with structural anti-skip enforcement. Given an issue, it researches the fix surface in plan mode, materializes a self-contained resumable HTML spec (work cards + embedded AI resumption prompt), creates an isolated worktree off the remote default branch, executes each work card (TDD Red-Green-Refactor where there is code), QA-validates against the spec's acceptance criteria in an iteration loop, and opens a PR — all through the Execute-Verify-Gate pattern at every step. No story file is required. Use when turning a GitHub issue into a hook-enforced, resumable sprint, or when the user runs /spec-sprint. Distinct from /create-sprint, which plans story sprints from an existing backlog; this skill is issue-driven and produces no story artifacts.

Drives an ad-hoc, resumable spec-driven sprint from a single GitHub issue with structural anti-skip enforcement. Given an issue, it researches the fix surface in plan mode, materializes a self-contained resumable HTML spec (work cards + embedded AI resumption prompt), creates an isolated worktree off the remote default branch, executes each work card (TDD Red-Green-Refactor where there is code), QA-validates against the spec's acceptance criteria in an iteration loop, and opens a PR — all through the Execute-Verify-Gate pattern at every step. No story file is required. Use when turning a GitHub issue into a hook-enforced, resumable sprint, or when the user runs /spec-sprint. Distinct from /create-sprint, which plans story sprints from an existing backlog; this skill is issue-driven and produces no story artifacts.

Analyze a Claude Code skill bundle and generate a full-fidelity GitHub incident for Codex import work via github-incident-from-observation. Use when the user asks to import, convert, port, or create an implementation incident for a Claude Code skill, including related hooks, subagents, and commands.

Capture, persist, and query research findings across sessions through a 7-phase workflow with structural anti-skip enforcement. Transforms web research, competitive analysis, technology evaluations, and market research into structured documents that survive session restarts. Prevents token optimization bias through per-phase reference loading, checkpoint persistence, Execute-Verify-Record enforcement, and artifact verification. Use when conducting competitive analysis, evaluating technologies, researching markets, planning integrations, or investigating architecture patterns. Always use this skill when the user runs /research or mentions research capture, knowledge persistence, or structured research documentation.

Capture, persist, and query research findings across sessions through a 7-phase workflow with structural anti-skip enforcement. Transforms web research, competitive analysis, technology evaluations, and market research into structured documents that survive session restarts. Prevents token optimization bias through per-phase reference loading, checkpoint persistence, Execute-Verify-Record enforcement, and artifact verification. Use when conducting competitive analysis, evaluating technologies, researching markets, planning integrations, or investigating architecture patterns. Always use this skill when the user runs /research or mentions research capture, knowledge persistence, or structured research documentation.