PinPoint

Security patterns, CSP nonces, input validation, auth checks, Supabase SSR patterns. Use when implementing authentication, forms, security features, or when user mentions security/validation/auth.

Use when running the superpowers plugin lifecycle inside PinPoint — brainstorming, writing-plans, subagent-driven-development, requesting/receiving-code-review, or finishing-a-development-branch — and when a superpowers step wants to merge a branch locally, remove a worktree by hand, run generic npm/pytest tests, dispatch subagents without a scale gate, or write a spec/plan from the read-only root. Also when deciding which bead field a spec, plan, acceptance criterion, or landing note belongs in.

Orchestrate parallel subagent work in git worktrees — task selection, end-to-end dispatch, monitoring, follow-up, and cleanup.

Full PR lifecycle for PinPoint — commit, push, CI monitoring, Copilot + human review handling (via MCP), readiness labeling, gate-enforced merge. Use when committing changes, opening PRs, watching CI, addressing review comments, or merging.

Per-PR /audit-override escape hatch for unrelated pnpm audit failures blocking CI Gate. Use when a PR's audit job goes red on a freshly-published advisory unrelated to the PR's own changes, or when explaining/debugging the /audit-override command.

Supabase/Postgres pooler and connection-string reference for PinPoint — Supavisor transaction vs session pooler, IPv4/IPv6, prepared statements, and the resolved PP-d8l8 silent-commit-loss incident. Use when touching src/server/db/**, scripts/migrate-production.ts, scripts/lib/pg-client.mjs, or any DB connection/pooler config.

Protocol for resolving drizzle/meta conflicts on merge — never edit the meta folder by hand, regenerate instead. Use when a merge or rebase produces conflicts under drizzle/meta or drizzle migration .sql/_snapshot.json files.

On-demand, TTL'd Supabase preview branches for PinPoint PRs — the /preview PR-comment control surface, sticky status comment, and hourly reaper. Use when setting up, debugging, or explaining Vercel preview deployments or the /preview command.

Inter-session coordination via daily/monthly beads injected by SessionStart, UserPromptSubmit, and (throttled) PostToolUse hooks. Manages bootstrap, daily rotation, identity registration, and self-filter. Use when you see a huddle identity announcement, a rotation-needed notice, injected coordination comments, or want to post an update for other sessions to read.

Design system rules, page archetypes, spacing rhythm, surface hierarchy, responsive strategy. Use when building any new UI, page, or component to ensure visual consistency.

Run in Claude Code to hand a specific bead to Antigravity. Emits a copy-paste prompt for the Antigravity 2.0 agent manager. Does NOT create branches or worktrees — the agent manager does that from the prompt text.

End-to-end runbook for Antigravity to pick an agy-ready bead, implement it, and bring it to ready-for-review. Follow every step in order. Do not skip steps.

Grooming skill for deciding whether to tag a bead agy-ready (and optionally agy-ui). Use during grooming sessions when evaluating whether a bead is suitable for Antigravity to execute autonomously.

Run a full project health review at session start or on demand. Answers "what should I work on?" before the orchestrator answers "how do I work on it?". Use when starting a new session, when user asks for a briefing, or before deciding what to pick up next.

Opt-in rapid-iteration mode for UI/UX prototyping — layout, components, styling, page structure, interaction/flow. Relaxes test/lint/type rigor on presentational code in favor of speed while tracking the resulting debt. NOT for backend/internal work (data layer, server-action logic, auth, permissions, migrations). Use when the user says "prototype mode", "rapid iteration", "vibe", or asks to explore a UI/design idea quickly without worrying about tests passing. Also read this to EXIT the mode.

shadcn/ui patterns, progressive enhancement, Server Components, Client Components, form handling, Tailwind CSS v4, accessibility. Use when building UI, forms, components, or when user mentions UI/styling/components/forms.

E2E testing guide for PinPoint (Playwright, Isolation, Mailpit, Supabase). Use when writing, debugging, or fixing E2E tests to ensure worker isolation and stability.

Testing strategy, bug-class-driven layer selection, PGlite patterns, Playwright best practices. Use when writing tests, debugging test failures, or when user mentions testing/test/spec/E2E.

Project-specific code patterns for Server Actions, data fetching, error handling, file organization. Use when implementing features to follow established patterns, or when user asks about project conventions/patterns/architecture.

TypeScript strictest patterns, type guards, optional properties (exactOptionalPropertyTypes), Drizzle query safety, null checks. Use when fixing type errors, implementing complex types, or when user mentions TypeScript/types/generics.