dev-conventions

Both uv and bun ship a native CVE audit subcommand, which is the part worth knowing — without it the reflex is to reach for pip-audit or safety and never find them. Covers the invocation for each, plus the two judgment calls that change what you do with a finding. Use when the user asks whether packages are safe, whether anything has a published advisory against it, for a CVE check, a vulnerability scan, or a dependency security audit, and before any release, publish, or handoff. Covers Python and JS/TS in a single pass.

House documentation conventions that are not derivable from the repo: last-updated dates, where unshared notes and session logs live, how dependency changes get recorded, and the rule against decorative counts in prose. Use when creating or updating documentation, READMEs, design docs, or session logs. Invoke with /dev-conventions:doc-conventions. Triggers on "write docs", "update README", "document this", "add a design doc", "session log", "numbers in prose".

House Python conventions plus the type-checking failures that get misdiagnosed: the dependency pinning policy (applications exact, libraries floors), the rule that linters, formatters and tests are never auto-run after an edit unless asked, and the two mechanical mistakes behind most Pydantic/Pyright diagnostic walls. Use when adding or pinning a dependency with uv add, when about to run ruff, pytest or a formatter after editing Python, when pyright reports a wall of "Arguments missing for parameters" or reportCallIssue, when a [tool.pyright] block seems to have no effect, when type errors appear on BaseModel subclasses whose fields have defaults, or when asked to suppress type errors in a Python project.