IronCode

Decision guide for delegating to caveman-style subagents. Tells the main thread WHEN to spawn `cavecrew-investigator` (locate code), `cavecrew-builder` (1-2 file edit), or `cavecrew-reviewer` (diff review) instead of doing the work inline or using vanilla `Explore`. Subagent output is caveman-compressed so the tool-result injected back into main context is ~60% smaller — main context lasts longer across long sessions. Trigger: "delegate to subagent", "use cavecrew", "spawn investigator/builder/reviewer", "save context", "compressed agent output".

Quick-reference card for all caveman modes, skills, and commands. One-shot display, not a persistent mode. Trigger: /caveman-help, "caveman help", "what caveman commands", "how do I use caveman".

Ultra-compressed communication mode. Cuts token usage ~75% by speaking like caveman while keeping full technical accuracy. Supports intensity levels: lite, full (default), ultra, wenyan-lite, wenyan-full, wenyan-ultra. Use when user says "caveman mode", "talk like caveman", "use caveman", "less tokens", "be brief", or invokes /caveman. Also auto-triggers when token efficiency is requested.

Compresses natural language files (markdown, text) into caveman-speak to reduce input token usage ~46%. Backs up original before overwriting. Only touches prose — code blocks stay exact. Trigger: /caveman:compress <filepath>, or user asks to compress a memory/doc file.

White-box code security audit. 5-phase protocol covering 55+ vulnerability types across 9 languages (Java, Python, Go, PHP, JS/TS, C/C++, C#, Ruby, Rust) and 10 security dimensions (D1-D10). Dual-track model: sink-driven + control-driven. Taint analysis, anti-hallucination verification. Writes CODE-AUDIT.md — read-only, no code changes. Human triages findings. Integrates Semgrep MCP when available.

Security-focused code review. Scans the current branch diff for vulnerabilities: injection, broken auth, authorization bypasses, cryptographic weaknesses, sensitive data exposure, and supply chain risks. Writes findings to SECURITY-REVIEW.md — read-only, no code changes. Human decides what to fix. Integrates Semgrep MCP when available.

Active web security scanner. Probes a live URL for security misconfigurations, exposed sensitive files, HTTP security headers, SSL/TLS issues, CORS policy, and information disclosure. Uses only curl + python3 — no extra tools needed. Only scan targets you own or have explicit written authorization to test.

Systematically QA test a web application using Playwright MCP. Use when asked to "qa", "QA", "test this site", "find bugs", "dogfood", or review quality. Modes: diff-aware (auto on feature branches), full, quick, regression. Produces structured report with health score, screenshots, and repro steps.

Systematic debugging. Use when encountering any bug, test failure, or unexpected behavior — before proposing fixes. Four phases: root cause investigation, pattern analysis, hypothesis testing, implementation. No fixes without root cause first. Use especially when under pressure or after multiple failed fix attempts.

Test-driven development. Use when implementing any feature, bugfix, or refactor. Enforces RED-GREEN-REFACTOR: write a failing test first, write minimal code to pass, refactor. Deletes code written before tests. No production code without a failing test first.

Verification before completion. Use before claiming work is done, tests pass, bugs are fixed, or builds succeed. Requires running the actual verification command and reading the output before making any success claim. Evidence before assertions, always.

Systematic REST/GraphQL API testing. Use when the project is a backend API without a web UI — or when asked to "test the API", "QA endpoints", "check the routes". Discovers routes from source code, tests every endpoint with valid/invalid/edge-case payloads, checks auth, validates response schemas, and produces a structured report with pass/fail evidence.

Fast headless browser for QA testing and site dogfooding. Navigate any URL, interact with elements, verify page state, diff before/after actions, take annotated screenshots, check responsive layouts, test forms and uploads, handle dialogs, and assert element states. Use when you need to test a feature, verify a deployment, dogfood a user flow, or file a bug with evidence. Powered by Playwright.

Post-ship documentation update. Reads all project docs, cross-references the diff, updates README/ARCHITECTURE/CONTRIBUTING/AGENTS.md to match what shipped, polishes CHANGELOG voice, cleans up TODOS, and optionally bumps VERSION.

Report-only QA testing. Systematically tests a web application and produces a structured report with health score, screenshots, and repro steps — but never fixes anything. Use when asked to "just report bugs", "qa report only", or "test but don't fix". For the full test-fix-verify loop, use /qa instead.

Systematically QA test a web application using Playwright. Use when asked to "qa", "QA", "test this site", "find bugs", "dogfood", or review quality. Four modes: diff-aware (automatic on feature branches — analyzes git diff, identifies affected pages, tests them), full (systematic exploration), quick (30-second smoke test), regression (compare against baseline). Produces structured report with health score, screenshots, and repro steps.

Weekly engineering retrospective. Analyzes commit history, work patterns, and code quality metrics with persistent history and trend tracking. Team-aware: breaks down per-person contributions with praise and growth areas.

Founder mode. Rethink the problem before writing code. Find the 10-star product hiding inside the request. Do not take the feature request literally — ask what the user is actually trying to accomplish, then propose the version that feels inevitable.

Pre-landing PR review for the IronCode monorepo. Analyzes diff against dev for type safety holes, race conditions, missing error handling, Bun-specific pitfalls, and structural issues that pass CI but break in production.

Ship a ready branch. Syncs with dev, runs format and typecheck, runs tests, pushes, and opens a PR. For a ready branch, not for deciding what to build. Follows IronCode conventions: branch from dev, format with Prettier, typecheck before push.

Tech lead mode. Lock in architecture, data flow, state model, failure modes, edge cases, security boundaries, and test matrix. Use after product direction is decided (after /ceo-review). Produces diagrams and an implementation plan with named files.

CEO/founder-mode plan review. Rethink the problem, find the 10-star product, challenge premises, expand scope when it creates a better product. Three modes: SCOPE EXPANSION (dream big), HOLD SCOPE (maximum rigor), SCOPE REDUCTION (strip to essentials).

Pre-landing PR review. Analyzes diff against dev for type safety, error handling, injection vectors, concurrency issues, and other structural problems that tests don't catch. Two-pass review: critical (blocking) + informational.

Ship workflow: merge dev, run tests + typecheck, review diff, update CHANGELOG, commit bisectable chunks, push, create PR. Fully automated — user says /code-ship and the next thing they see is the PR URL.

Eng manager-mode plan review. Lock in the execution plan — architecture, data flow, diagrams, edge cases, test coverage, performance. Walks through issues interactively with opinionated recommendations.

Use this when you are working on file operations like reading, writing, scanning, or deleting files. It summarizes the preferred file APIs and patterns used in this repo. It also notes when to use filesystem helpers for directories.