octorato

Hard-won fixes for standing up the lharries/whatsapp-mcp bridge (whatsmeow + WhatsApp Web multidevice), encrypted, with send as a reversible dial. Covers the 403 media-download root cause (direct path stripped of its CDN auth query), the 405 client-outdated fix (bump whatsmeow + add context.Context to changed APIs), QR-vs-phone-code pairing, encrypt-at-rest without sudo (gocryptfs static binary), read-only vs send-enabled enforcement, and liveness/identity/verification gotchas (bridge freshness probe, @lid JID migration, outgoing REST sends absent from messages.db) and the outbound anti-spam discipline (no bursts to new contacts; device-removed recovery). Load before installing or debugging a personal WhatsApp MCP.

End-of-day / end-of-session honest retrospective. Trigger when the operator asks "¿qué aprendiste hoy?", "¿qué harías mañana para ser mejor?", "what did you learn today", "how would you be better tomorrow", "reflexiona", or "/reflect". Runs a sourced, no-flattery retro on the ACTUAL session (mistakes first, they are the value), answers the three questions, and DISTILLS the sharpest lesson into brain memory so the reflection becomes a reflex, not just words. Different from session-learn-extractor (which extracts a reusable TECHNIQUE into a draft skill); this captures BEHAVIOR and discipline and writes a feedback/lesson MEMORY.

Build a deterministic, queryable knowledge graph over any codebase with graphify (tree-sitter AST over 25+ languages, Leiden clustering, flat graph.json, zero LLM cost for code-only corpora) and query it via CLI or MCP. Use inside a client repo for code-level impact analysis (graphify affected), symbol path tracing, and architecture questions that grep answers poorly. Complements the brain's connectome/lineage graphs: graphify maps CODE SYMBOLS, the connectome maps CONCEPTS and governance. auto-promoted 2026-07-16 from repo-deep-learn (https://github.com/Graphify-Labs/graphify).

Full operational protocol for the Octopus 4D Paradigm — Describe / Delegate / Diligent / Disclose. Contains the 2D Delegate 3-question gate detail, the 4D Gate Change Manifest format, the 3D Diligent validation matrix, the Impact Radius scan command, the 4D-applied-to flow tables, known anti-patterns, and the enforcement scripts. CLAUDE.md carries only the summary; full templates and formats live here. Load when about to write files, run a complex change, build a Change Manifest, or need an exact gate/diligent/impact-radius format.

Frontier brain, tiered arms: keep the orchestrator on a frontier model and DELEGATE by complexity; never downgrade the main loop itself. Tiers are vendor-agnostic (mechanical · bulk · build · judgment). Map them to the runtime's engines: Claude Code → Haiku/Sonnet/Opus/Fable; Cursor+xAI → composer/grok-build · mid-Grok · grok-4.5 · strongest independent ≥ builder. Cuts per-client token spend at the baseline, not just at the cap. Load when fanning out many sub-agents (Workflow/Agent/Task), when an arm's FinOps cost needs lowering without changing the deliverable, or when deciding the `model` override for a Workflow stage or Agent/Task call. Pairs with budget caps: caps stop runaway spend; routing lowers the floor. See docs/architecture/multi-runtime.md.

Browser automation CLI for AI agents (Rust native, no Playwright). Use for navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, QA/dogfooding, automating Electron desktop apps, Slack automation, or any browser task. Triggers: 'open a website', 'take a screenshot of the site', 'fill out a form', 'test this web app', 'dogfood', 'QA', 'check my Slack', 'automate VS Code/Slack/Discord'. Prefer over Playwright on all platforms.

Pre-send QA reflex for GENERATED client deliverables (cotización, propuesta, contrato PDF/DOCX). Lints the rendered artifact for stripped accents, em-dash, already-past forward dates (kickoff/vigencia), missing fiscal note ($ amounts with zero IVA mention = FAIL), and inventories every $ amount for human eyeballing. Run it before declaring any client doc "listo para enviar". Complements cadence-lint.py (which lints prose SOURCE, not the rendered output).

Clausulado legal base (México B2B) que TODA cotización o propuesta de servicios debe incluir desde el borrador 1, no después de que un review lo cache. Cubre propiedad intelectual (obra por encargo), tratamiento de datos personales (LFPDPPP, encargado), confidencialidad/NDA, límite de responsabilidad, garantía y soporte post-entrega, responsabilidad de licenciamiento e impuestos (montos más IVA, desglose en CFDI). Texto genérico reutilizable, sin datos de cliente.

Operator-canonical: fix the ROOT CAUSE, never ship the quick patch or a pile of palliative files in its place. Two smells mean STOP and do it right: the phrase 'the quick fix is...' (in any language), and accreting band-aid files instead of repairing the one broken thing. Harmonizes with execution-bias (start today, do not defer) on the other axis: speed-to-start is a virtue, speed-by-shortcut is debt. Load before proposing a fix, when tempted by a workaround, or when a change is growing extra files instead of mending the source.

Measure brain/agent cost so it can be managed — 'lo que no se mide no crece'. Routes a cost/FinOps question to the right existing tool: per-arm spend, routing KPI ($ saved vs all-Opus), marginal cost of each new capability, est-vs-billed reconciliation, per-skill ROI. Load when the operator asks how much we spent, whether something is cheap or expensive, 'cuánto gastamos/cuesta', which arm/model/skill is eating tokens, whether model-routing is working, or whether a new capability made us pricier.

Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations.

Determine code/file ownership by git authorship (log/blame), never by which repo it lives in. Load before assigning work, escalating a fix to "another team", or routing a problem by repo location — the author may be on your own team. Repo location is not ownership.

The two symbolic anchors of the Octorato framework — the 8 → ∞ (lay the octopus's eight arms sideways and you get the lemniscate, the unbounded) and the Tesseract → 4D (the four-phase paradigm is the 4-dimensional analog of a cube). Invoke when explaining naming rationale, brand identity, the philosophical layer, or when authoring launch comms / talks / podcasts that touch the framework's depth.

A scheduled capture/scrape/monitor pipeline that only dumps raw data to files forces the operator to do the synthesis by hand, so the synthesis gets skipped and directed asks (review requests, red builds, @mentions) are missed for days. The fix is a mandatory last step that TRIAGES: it diagnoses each surfaced issue to a cause and a next action, not just lists it. Trigger when building or reviewing any daily/periodic capture job (Teams/Slack/email scrape, CI status pull, repo watch, metrics dump).

Conditional-Access-resilient OAuth alternative for Microsoft Graph: drive a Playwright + Edge persistent context to capture the bearer token during normal sign-in. Works when Device Code Flow / headless OAuth is blocked by AADSTS53003 (Device state: Unregistered). Outlook Web grants a broader scope set than Teams Web. Hard-won workaround that should NOT be the production answer.

Canonical mandate — never ask the operator "should we pause?" or "do we close the session?" when there is queued work, an open PR waiting on the agent, or a clear next step. Continue working until either (a) genuine decision input is required, (b) all known work is done, or (c) the operator explicitly says to stop. Triggers — any time the agent is about to ask if it should pause / close / wrap up the session.

Send a 1:1 Microsoft Teams chat message via Graph API even when the bearer token does NOT carry `Chat.Read*` scopes. Bypasses the list-chats-then-find-id pattern by deriving the 1:1 chat ID deterministically from sorted user OIDs in the canonical Teams form `19:{sortedOidLower1}_{sortedOidLower2}@unq.gbl.spaces`. Pairs naturally with browser-bearer auth where Conditional Access blocks Device Code Flow and the resulting tenant-scoped bearer carries `ChatMessage.Send` + `User.ReadBasic.All` but not `Chat.Read*`.

Every long-form technical document combining a framework explanation with a use-case demonstration MUST carry executable real-data prompts alongside the conceptual claims. No theory without prompts. No prompts without theory. The medium imitates the substrate. Triggers — authoring a Confluence POC page, an arm-level whitepaper, a client deliverable, a developer-facing onboarding doc, ANY artifact that asks the reader to act on what they read.

When shipping generated config, IaC, dashboards, or alert rules (Datadog, Terraform, CI YAML, SQL/KQL/PromQL), schema-valid is NOT semantically correct. External identifiers (metric names, API fields, table columns, env keys) can parse and import cleanly yet render No Data or wrong values because the name does not exist. Verify every external identifier against authoritative vendor docs before shipping, and run an adversarial multi-lens expert panel over non-trivial artifacts. Trigger when generating dashboards, monitors, IaC, pipelines, or any config that references another system's identifiers.

When the operator asks for a message to paste into a chat client (Teams, Slack, WhatsApp, any plain-text box), DO NOT put the message body in the chat response. Write it to a plain-text .txt file (UTF-8, LF, no markdown) and hand back the path. Copying from the terminal's rendered markdown injects stray spaces, double line breaks, and smart quotes that look broken when pasted. Trigger whenever the operator says "dame el mensaje para pegar", "pásame el texto para Teams/Slack", "el mensaje para el grupo", "draft for the chat", or is going to paste your output into a messaging app.

Before you state the CAUSE of a failure to a stakeholder (client, teammate, ticket), verify the cause against the data, not just the symptom. A plausible but unchecked causal claim that turns out false damages trust more than saying "the exact cause I'll confirm in a moment". Trigger whenever you are about to write "the reason X happened is Y" / "it failed because" / "that's due to" in any outward-facing message, PR description, incident note, or status update.

Daily monitor for a small watchlist of high-value GitHub repos (competitors, peers, upstream Claude Code ecosystem). Reads `skills/repo-watch/watchlist.yaml`, fetches HEAD SHA per repo, diffs against the previous snapshot, classifies the delta as HIGH/LOW/EMPTY/BASELINE signal, appends to a daily digest at `~/.claude/knowledge/repo-watch/<date>.md`, and writes file-based trigger markers for `/repo-deep-learn` to pick up out-of-band. Use when the operator wants to keep a finger on a competitor's pulse (first target — affaan-m/ECC, the 197K-star octorato parallel) without staring at GitHub all day. Sibling of [[github-trending-curation]] (autonomous breadth) and [[repo-deep-learn]] (manual depth).

Extract structured insights from short-form social video (TikTok, YouTube Shorts, Instagram Reels, Bilibili, Douyin) WITHOUT paid speech-to-text — uses yt-dlp for video acquisition, ffmpeg for frame extraction, native multimodal vision (Read on JPGs) for on-screen text/logo identification, and WebFetch for source verification. Use when curating OSS tools from a creator channel, when mining tech-curator content for skill candidates, when transcripts are unavailable / blocked / too expensive, or when on-screen overlays carry the actual signal (project names, URLs, stats, logos).

Non-obvious Snowflake and dbt footguns that fail silently or destroy data. Load when writing or reviewing Snowflake DDL (CREATE OR REPLACE, Dynamic Tables, PIVOT) or dbt config (sources.yml freshness, versioned models). Each pitfall has a concrete prevention. Triggers - "CREATE OR REPLACE TABLE", Snowflake Time Travel / UNDROP, Dynamic Table refresh errors, PIVOT returning literals/nulls, dbt source freshness passing when it should not, dbt versioned-model YAML parse error that survives typo fixes.

Asistente de trámites gubernamentales/burocráticos guiado por agente. Reúne la identidad del operador desde los conectores (Gmail/WhatsApp/Drive/archivos locales), maneja un portal oficial con agent-browser (o Skyvern para formularios WRITE pesados), se DETIENE en los muros que por diseño son humanos (reCAPTCHA/Turnstile, OTP, pago con tarjeta, biométricos de primera vez), entrega al humano solo eso, y recoge el resultado (PDF) del correo. Úsalo para constancias de antecedentes penales, actas, apostillas, citas consulares, visados, SAT/IMSS y trámites análogos. NO intenta vencer captchas ni automatizar pagos.

MANDATORY isolation for concurrent Claude Code sessions on one repo (especially ~/.claude itself). The same arm can run in two dimensions at once, but each live session MUST have its own git worktree + session id. Never two on one shared working tree. Documents the real collision (a broad git add in one lane swallows the other lane's uncommitted files), the octopus-morphology framing (instance isolation = Arm Isolation across time), the worktree protocol, and Anthropic's official `claude --worktree` guidance. Load before starting a second session on a repo, when two agents share ~/.claude, or when investigating 'my changes got committed by another session / ended up on the wrong branch'.

A long-lived service that hangs INTERMITTENTLY on SIGTERM (non-reproducible, the init system kills it at the timeout, a false OnFailure alert fires and then self-recovers) is not a bug to chase. Install a deterministic daemon-timer backstop (os._exit after N seconds) inside the shutdown path. The race is unfixable by inspection; the backstop is.

A Facebook Page has TWO different identifiers: the URL ID seen in `profile.php?id=N` (and in the page's vanity URL) and the Graph API ID returned by `me/accounts` / used in API calls. They are NOT interchangeable. Worse, the New Pages Experience reuses the `profile.php?id=N` URL shape for Pages too, so the URL no longer tells you whether a target is a Page or a personal Profile. Store and match on the Graph API ID.

A long-running process (a cron supervisor, a daemon, a worker pool parent) caches a NEGATIVE DNS result after a transient network blip and then never retries, so every downstream call fails forever even though the network recovered seconds later. A wrapper bug can log a fake `exit=0`, hiding it. Symptom: 'nothing runs anymore' with no error. Fix: restart the process, then bound the DNS/connection cache TTL.

The 10 no-rules that strip AI-tells from any written output so text reads like a person, not a model, and costs fewer tokens. Inverted from the soyfelixgo TikTok 'humanizer' prompt into hard DON'Ts. ALWAYS-ON delivery discipline: every output (chat, email, doc, commit body, PR description) passes these before it ships. CLAUDE.md §Communication carries the summary; the verbatim source + per-language blocklists + reconciliation live here. Load when drafting prose, humanizing AI text, or auditing why a draft 'sounds like AI'.

Daily brain learning loop for AI news and blogs. Reads a watchlist of RSS/Atom feeds (Simon Willison, OpenAI, DeepMind, Latent Space, arXiv cs.AI and more), classifies each recent article into brain-fit buckets via heuristics + an optional Groq LLM gate, and surfaces only the ones that teach something the brain doesn't already know. Output lands in `~/.claude/knowledge/news-articles/<date>.{md,json}`. Promote a keeper to a real skill with `/news-promote <date> "<title-substring>"`. Sibling of github-trending-curation; this is the INBOUND half (blog feeds we can learn from), the news section on the site is the OUTBOUND half (skills we already learned).

Before sending a reply to a formal requirement (bank, government agency, any institution), build an explicit checklist of EVERYTHING the requesting message demands (attachments, signatures, formats) by re-reading the source file on disk, and audit the outbound package manifest against it. Trigger, any outbound submission answering an inbound requirement, especially when the inbound was summarized by a sub-agent.

When a rule or gate is chronically ignored, when designing enforcement for a new policy, or when the operator says a rule keeps failing. Teaches how to convert a passive "mental check" into a mechanical hook (ganglion) that fires without the central brain invoking it.

Don't defer to 'later / follow-up / next session' what can be done now. If no real blocker and auto-mode is on, execute without asking. The 'green light' is auto-mode itself.

Two hard-won rules for any Python script in ~/.claude/scripts/ that must run on a Windows brain: (1) `python3` resolves to the Microsoft Store stub by default — depend on the `python3.cmd` shim installed by install-runners.py, never on bare `python3`. (2) ANY script that prints Unicode (✓ ✗ — • → bullet/check/arrow) MUST reconfigure stdout/stderr to UTF-8 at module top — Windows cp1252 consoles crash mid-print otherwise, leaving the script's work half-reported. Use proactively when writing a new brain script, when touching an existing one, or when triaging a Windows-only crash.

Canonical mandate — when presenting any multi-choice question to the operator (via AskQuestion or inline list of options), ALWAYS include (a) the options laid out neutrally, (b) a clear recommendation marked with `★ Recomiendo X` / `★ Recommendation: X`, and (c) reasoning covering impact / scope / timing / risk-of-waiting. Listing options without an opinion offloads cognitive work onto the operator — that is the slow ping-pong this skill kills. Triggers — every time you are about to send a "what next?" with 2+ options, every `AskQuestion` tool call, every "do you want X or Y?" in conversational prose.

Cross-plane sentinel pattern: a tiny watcher on cloud plane B detects the SILENT death of scheduler plane A (billing block, cron load-shedding; zero error signal from inside) and alerts the operator by email. Fail-open: the canary's own failure never harms the host work. Includes the fine-grained-PAT 403 gotcha, the no-echo secret intake protocol, and the MANDATORY live test (a canary never test-fired protects nothing). Load when schedulers die silently, when 'nothing ran and nothing alerted', when building any watchdog/canary, or when activating one that has never fired.

Step-by-step protocol for creating a new client arm (per-client repo) in the Octopus framework. Covers required files, the sync-ai-docs workflow, the arm's sealed lineage graph (.claude/connectome/lineage.yaml), QueryMaster connection registration, the one-file rule, and the gitignore hygiene baseline. Load whenever the operator says 'create a new arm', 'onboard a client', 'mkdir new project', or starts working in an empty directory under ~/Documents/github/.

Build a fail-closed PreToolUse gate for merge/deploy/destructive actions that the AI agent provably cannot self-bypass. Use when you need human-only override for a consequential action the agent orchestrates.

Pattern-match what a Bash command actually does in a PreToolUse hook without false-firing on mentions inside quoted args, commit messages, or echo strings. Use when building any hook that decides based on command semantics.