dev-core

Adversarial review method for skills, agents, and workflow.js harnesses. Use when creating or reviewing AI artifacts, or auditing the repo's automation for correctness, safety, and silent-failure bugs.

Guidelines for writing high-quality Claude Code agents and subagent definitions. Use when creating new agents, reviewing existing agents, or designing multi-agent workflows.

Code quality standards, naming conventions, and review checklist. Use when writing or reviewing code for style, naming, logging, or review readiness.

Context for data storage work — databases, SQL, ORM, migrations, query optimization, and connection management. Activate when building data access layers, writing migrations, or optimizing queries.

Context for security-sensitive work — authentication, authorization, secrets management, input validation, and OWASP concerns. Activate when building auth flows, handling credentials, or processing untrusted input.

When to delegate read-only investigation to a subagent instead of reading inline, with the measured break-even. Use when surveying many files, tracing a convention across a tree, or answering "where is X handled".

Phased feature development and task decomposition guidance. Use when implementing new features, planning multi-step tasks, or decomposing complex work.

Documentation standards, progressive writing, and organization patterns. Use when writing documentation, docstrings, READMEs, or reviewing existing docs.

Detect drift between issue plans and actual implementation. Compares planned files, acceptance criteria, and scope against git changes. Use before shipping to catch scope drift early.

Error handling patterns, retry strategies, and resilience guidance. Use when implementing error handling, validation, retry logic, or graceful degradation.

Git commit conventions, branch naming, and PR workflow. Use when committing, creating branches, reviewing PRs, or investigating git history.

Implementation loop that drives the "Make it Documented" pass — public API documentation, design decision comments, and README updates for changed code. Activated by contexts or always run as a core pipeline step. Not invoked directly.

Implementation loop that drives the "Make it Right" pass — refactoring for clarity, conventions, and architecture without changing behavior. Used by the pipeline orchestrator during implementation phase. Not invoked directly.

Implementation loop that drives the "Make it Secure" pass — hardening against injection, secrets exposure, and OWASP top 10 vulnerabilities. Activated by security and data-storage contexts. Not invoked directly.

Implementation loop that drives the "Make it Tested" pass — comprehensive test coverage for changed code with behavior-focused assertions. Activated by contexts or always run as a core pipeline step. Not invoked directly.

Implementation loop that drives the "Make it Work" pass — real end-to-end functionality on the happy path. Used by the pipeline orchestrator during implementation phase. Not invoked directly.

Two-tier memory conventions for .claude/memory/ — long-term committed team knowledge vs short-term gitignored session state. Use when deciding where to store persistent information.

Shell scripting conventions, naming patterns, and testing guidance. Use when writing or editing shell scripts, bash functions, or shell tests.

Guidelines for writing high-quality Claude Code skills and AI agent instructions. Use when creating new skills, reviewing existing skills, or writing CLAUDE.md / rules files for any AI coding tool.

Test-first development patterns and framework conventions. Use when writing tests, adding coverage, or debugging test failures.

Guidelines for writing Claude Code workflow.js harnesses — the Workflow-tool scripts that fan out subagents under a shared budget. Use when creating or reviewing a workflow.js harness or its agent contract.