菜单
Deterministically plan, implement, verify, compare, or render remediation for a validated DevForgeAI enterprise audit run. Use when given an explicit audit run ID or normalized finding ID; never use for custody-chain story audits or raw Markdown findings.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Independently validate a pull request from another AI session before a human merge. Enforce CI/head-SHA triage, an isolated review worktree, repository gates, negative-path proof for guards, reproduced findings, a three-tier verdict, cold fix handoff, delta review, and an explicit merge-or-hold outcome. Use for delegated builder PR review, fix delta review, or agent-work validation. Do not use for your own uncommitted diff or a plain human-authored PR without delegation context.
Independently validate a pull request from another AI session before a human merge. Enforce CI/head-SHA triage, an isolated review worktree, repository gates, negative-path proof for guards, reproduced findings, a three-tier verdict, cold fix handoff, delta review, and an explicit merge-or-hold outcome. Use for delegated builder PR review, fix delta review, or agent-work validation. Do not use for your own uncommitted diff or a plain human-authored PR without delegation context.
Execute a rejected pull request's fix round as a cold implementer session. A reviewer found defects and wrote a handoff comment with numbered findings and C0–C7 checkpoints; work that punch list under invariants enforced by a PreToolUse hook and gate scripts — reproduce the reviewer's red before touching the tree, stay inside the handoff's fence, one `F<n>:` commit per finding, record the output of every acceptance criterion, post a closing report, and STOP without merging. Use whenever a review comes back with changes requested and you are handed the PR plus its findings. Do not use it to author the original plan (that is `delegate`), to build a slice from a plan with no prior review (that is `implement-workflow`), or to review someone else's PR (that is `review-workflow`).
Execute a rejected pull request's fix round as a cold implementer session. A reviewer found defects and wrote a handoff comment with numbered findings and C0–C7 checkpoints; work that punch list under invariants enforced by a PreToolUse hook and gate scripts — reproduce the reviewer's red before touching the tree, stay inside the handoff's fence, one `F<n>:` commit per finding, record the output of every acceptance criterion, post a closing report, and STOP without merging. Use whenever a review comes back with changes requested and you are handed the PR plus its findings. Do not use it to author the original plan (that is `delegate`), to build a slice from a plan with no prior review (that is `implement-workflow`), or to review someone else's PR (that is `review-workflow`).
Create Web, GUI, or Terminal design specifications in story, standalone, or extract mode from a customizable brief, brand, and visual direction; generate design.md, implementation artifacts, and web artifacts when the selected target is Web. Use through /create-design when a project needs a design source of truth or an existing mockup must be extracted.
Create Web, GUI, or Terminal design specifications in story, standalone, or extract mode from a customizable brief, brand, and visual direction; generate design.md, implementation artifacts, and web artifacts when the selected target is Web. Invoke explicitly with $spec-driven-design.
| name | remediating-devforgeai-audit |
| description | Deterministically plan, implement, verify, compare, or render remediation for a validated DevForgeAI enterprise audit run. Use when given an explicit audit run ID or normalized finding ID; never use for custody-chain story audits or raw Markdown findings. |
Require explicit native arguments: run-id=<run-id>, optional
finding=<id>, dry-run=true, or resume=true. Do not depend on slash-command
state or hidden context.
audit-findings-status for run-id. Reject raw Markdown as execution
state; only a validated durable register is accepted.audit-content-validate and audit-import-completed only for immutable
completed-report intake. Use audit-findings-build once after intake.dry-run=true stops before mutation.audit-remediation-record. Do not edit status, events, approvals,
evidence, closures, reports, or intake snapshots.audit-remediation-verify; dispatch native audit-closure-verifier
only after implementation evidence is complete and from a different actor.audit-remediation-compare only after protected-main re-audit and
audit-remediation-render only as a read-only projection.HALT on missing CLI, exit 127, malformed JSON, missing state/schema, stale generation, wrong commit/worktree, unsupported provider capability, invalid approval, or incomplete evidence. Do not mark a finding closed before human merge and protected-main re-audit.
The shared CLI owns parsing, fingerprints, dependencies, transitions, approvals, evidence, comparison, and closure. This skill is orchestration only.