voitta-ai

by voitta-ai

Audit a multi-source metrics client before believing its zeros: a 0 usually means the source never populates the field, not that the user did not do it.

by voitta-ai

A Micronaut management endpoint 401s with no security library on the classpath, because endpoints.* is read from the YAML document root and a copy nested under micronaut: binds to nothing.

by voitta-ai

Run a multi-phase feature as stacked worktree PRs so each phase reviews independently.

by voitta-ai

Identify which Neon project backs a Vercel app and migrate/split it; pg_dump>=server; safe non-destructive cutover.

by voitta-ai

Integration-test an OAuth2 client-credentials caller END TO END while asserting how often it mints tokens, by pointing its config-driven token endpoint at a counting pass-through proxy the spec starts (JDK com.sun.net.httpserver on an ephemeral port) instead of mocking the transport. Use when: (1) a service caches or refreshes a bearer and its unit specs stub the HTTP layer, so a per-request-mint or never-refresh defect is invisible; (2) you must prove in one run that the real gateway rejects a missing bearer, accepts a minted one, refreshes a stale one, AND that N calls mint once; (3) the token endpoint is read from configuration. Caught a real "three lookups, three mints" defect that 22 green unit specs missed.

by voitta-ai

Diagnose OpenClaw model-cascade failures (gateway process up but every run FailoverErrors because all providers are down), build a free OpenRouter fallback basket to survive codex cooldowns, and verify with one-shot `openclaw agent`.

by voitta-ai

Measure a repo's conversion rate (maintainer share of merges, outside PRs waiting, unreleased commits, bot-only reviews) before choosing patch vs issue; write the issue as a spec with reproduction, mechanism, one-PR ask and a kill condition; cross-link duplicates; close your superseded PR with a pointer.

by voitta-ai

Avoid duplicating, superseding, or clobbering work done by another agent session on the same repos: the three collision shapes, the pre-flight check for each, and how to reconcile without losing the better version. Also covers the collision that no artifact check can catch -- two sessions both about to do the same work, with nothing pushed for `gh pr list` to find -- detected by enumerating live peer sessions and asking directly, then split into named lanes with an explicit gate and the decision routed through the shared human. v1.2.0 moves the peer check earlier still: to the first act that CLAIMS shared state -- git worktree add / checkout -b -- because two sessions given the same issue derive the same branch name by default, and a live drill showed both colliding there an hour before either noticed. Adds the rule that you never `git add -A` in a tree you do not exclusively own (that is how one session's commit silently absorbed another's work under a wrong message), and how to read a peer's silence from its ListAgents state, where `waiting` means blocked on user input and your message will not be processed until a human interacts.

by voitta-ai

Diagnose WHICH permission gate refused a command when two are active, and why a standing allow rule did not stop it: the opt-in autoMode.classifyAllShell (default false) suspends every Bash/PowerShell allow rule while auto mode is active, while outside auto mode the same rule applies and bypasses PreToolUse hooks entirely

by voitta-ai

Audit what a service actually auto-runs when it reuses a permission gate built for an interactive terminal. The gate reads a human's editor settings, so an agent or bot driven by other people's input inherits that human's personal allow-list -- measured on one deployment: 123 Bash() patterns, including gh pr merge, gh api and codex exec, auto-running with no approval card. Use when a command you expected to need approval ran without one, when a verdict says "matches user allow pattern", when wiring such a gate into a service, or when a suite's verdicts change with whose machine runs it. Covers locating the discovery paths, measuring and proving the surface with the gate's own verdicts, cutting the inheritance off upstream rather than around it, and asserting at boot that it stayed cut.

by voitta-ai

Audit and clean up personal `~/.claude/skills/` copies that duplicate or shadow skills a plugin bundle also ships, so sessions stop silently running stale versions. Use when: (1) a skill you know was updated upstream behaves like an old version (e.g. it ran at 4.0.0 while the installed bundle ships 4.1.0), (2) you are asked "can I just delete the local copy?" of a skill that also exists in a plugin, (3) `~/.claude/skills/` has accumulated copies of skills that later moved into a plugin bundle, (4) a skill appears in the session's skill list bare (no `plugin:` prefix) and you need to know which file on disk that actually is, (5) after installing or updating a bundle plugin you want to retire the loose per-skill installs it replaced. Key trap: `~/.claude/plugins/marketplaces/<mkt>/` is the fetched marketplace source, NOT loaded — only plugins present under `~/.claude/plugins/cache/` serve skills, and a bundle can turn out not installed at all, leaving the personal copies as the sole (stale) provider. Covers the audit commands (version drift table, two-way content diff against the cache copy), the delete / keep decision tree (byte-identical, version-behind with superseded wording, genuine unpushed fork), and the tar backup before any rm.

by voitta-ai

Upload a file via Playwright MCP when the input is hidden: unhide+tag via evaluate, upload by id, verify via CDN/S3 URL.

by voitta-ai

A review-fix amend + force-push that lands after the reviewer's squash-merge succeeds silently and never reaches the default branch: the merge snapshots the head GitHub had when the merge ran, the later force-push still updates the branch ref without any warning, and the default branch keeps the pre-review version. Use when: (1) you force-pushed to a PR branch while the PR was under active review or had auto-merge armed, (2) a merged PR's requested change is mysteriously absent from the default branch though your branch has it, (3) a stacked follow-up branch starts failing validation after a rebase on something the amendment fixed (e.g. terraform's `Error: Reference to undeclared resource`), (4) `git show origin/<default>:<file>` shows the pre-amendment shape of a file you know you fixed. Covers the post-push detection check, the tree-diff test that works despite squash-merge ancestry breakage, and the carry-the-fix-forward recovery.

by voitta-ai

Paired PR-loop skills: work-on-pr (author) + review-pr-loop (reviewer).

by voitta-ai

Audit a git repo for leaked secrets before making it public: scan tracked files AND full history, avoid the git grep -E \b false-negative, catch tracked editor-backup files, and decide rewrite+rotate vs. accept an inert identifier.

by voitta-ai

Block a credential at commit time with a gitleaks pre-commit hook, and cover new repos automatically via init.templateDir. The six paths that skip the hook, where the default ruleset is blind, why a staged-diff scan is not a history scan, and GitHub push protection plus CI as the halves that cannot be bypassed locally.

by voitta-ai

Build a correct Python ast static analyzer: resolve import aliases and model module-load vs deferred (call-time) execution.

by voitta-ai

Reverse-engineer a React Native Hermes-bytecode Android app off a stock non-rooted device: hermes-dec on unsupported versions, string-table flow tracing, the user-CA TLS wall, no-root BLE/HTTP capture.

by voitta-ai

Reviewer-side PR iteration loop. Re-reads issue + prior threads each round, reviews only the new diff or latest author response.

by voitta-ai

An RxJava test that asserts a side effect of `doFinally` (a released semaphore permit, a decremented in-flight gauge, a closed resource) immediately after `TestObserver.await()` / `blockingGet()` is racy BY CONSTRUCTION: the operator delivers the terminal event to the downstream observer FIRST and runs the finally action AFTER, so the awaiting thread can observe the pre-release state. Use when: (1) CI fails with something like "permits should be returned once the held requests complete ==> expected: <0.0> but was: <1.0>" while the same test passes locally and in other parameterizations, (2) deciding whether such a failure is a REAL resource leak or a test-harness race, (3) writing tests around `doFinally`-based cleanup and choosing between asserting immediately and polling, (4) tempted to claim "fixed locally, 5/5 green" for a race your machine never reproduced. Covers the RxJava source proof, the leak-vs-race differentiation signals, the polling-assert fix, and the control experiment that tells you whether local runs mean anything.

by voitta-ai

Handle credentials during a coding-agent session without writing them into the transcript, tool-output cache, permission allowlist or logs. Fingerprint comparison, ask-the-service identification, and env-to-file transfer that never passes through the model. Ships an advisory PreToolUse hook that flags credentials in Bash commands before they run.

by voitta-ai

Prove nothing consumes an AWS Secrets Manager secret before a terraform plan destroys it: query CloudTrail per resource, classify GetSecretValue (a real consumer) against DescribeSecret/GetResourcePolicy (your own CLI and posture scanners), subtract your own terraform refresh, and check reversibility separately -- because a populated LastAccessedDate is not evidence of use.

by voitta-ai

Sweep every Claude Code session transcript on a machine for skill-worthy knowledge: root-caused bugs, non-obvious gotchas, painfully derived procedures - and for HOMELESS artifacts (skills written to ~/.claude/skills but never committed, skill edits stranded in worktrees, harvest PRs left open). Use when: (1) asked to "mine sessions", "harvest what we learned", or "sweep transcripts for skills", (2) daily/per-session harvesting has been running and you need the periodic catch-up pass that finds what it missed, (3) a skills repo looks behind what you know was learned recently, (4) you need to reconstruct what a lost or crashed session discovered. Method verified at scale: 50+ sessions condensed and mined by 8 parallel subagent miners in one sweep, yielding 22 shipped skill PRs.

by voitta-ai

Land a newly captured skill through the ONE peer session already working the skills repo: capture side authors skills/<name>/ content only (never registry files), leak-screens it, pushes branch add-skill-<name> and messages that single session; landing side does registry, versions, validators, PR. Falls back to claudeception's own wiring when no such peer exists.