devflow

Architecture Decision Record — document significant technical decisions with context, trade-offs, and consequences. Trigger when user says "record this decision", "create ADR", "write an ADR", "document why we chose", or at architecture pivot points requiring documentation. Do NOT trigger for questions asking why a decision was made.

Audit project for security vulnerabilities and dependency CVEs. Modes: --deps (dependency vulnerability scan via npm audit / pip-audit / cargo audit), --security (OWASP Top 10 + business logic scan using security-reviewer agent), --all (both). Use for pre-release security reviews, compliance checks, or when adding new dependencies. Triggers: security audit, CVE scan, vulnerability check, npm audit, dependency audit, OWASP, security review.

Full development loop for any coding task — features, bug fixes, refactors, hotfixes, or Jira tickets. Research → Plan → Implement → Verify → Review → Ship with Agent Teams and auto-detected ceremony level. Pass Jira key to extract AC. Start here when unsure which workflow to use.

Activate safe-mode for the current session — blocks destructive bash commands and requires confirmation for risky operations.

Iteration macro skill — build + test loop for rapid development cycles. Trigger when user says "code this for me", "implement this feature", "let's code this", or in the middle of active feature work needing quick iteration without full review. Do NOT trigger for questions about how to implement something.

Show devflow metrics dashboard — session summary, anomaly alerts, reviewer calibration accuracy, and skill usage frequency. Triggers: metrics, dashboard, session summary, workflow health, iteration count, regression trends.

Parallel root cause analysis with Agent Teams — Investigator + DX Analyst run concurrently, then Fixer applies targeted fix with DX hardening. Use for bugs, test failures, or unexpected behavior.

Generate documentation for code — API endpoint docs, README sections, or inline JSDoc/TSDoc comments. Modes: --api (document REST API endpoints from route/controller files), --readme (generate or update README sections for new or changed features), --inline (add JSDoc/TSDoc to exported functions and classes lacking documentation). Reads existing docs to match project style before generating. Triggers: generate docs, document API, add JSDoc, update README, write documentation, TSDoc, API reference.

Scan codebase for environment variable references, cross-reference with validation schema, and fix mismatches. Use when env var errors occur or adding new environment variables.

Lock edits to a specific directory or file for this session — blocks Edit and Write tools on matching paths.

Automated git-flow merge and deploy — feature, hotfix, and release modes with pre-merge safety checks. Use to merge a branch to main/develop.

Retrospective report from devflow-metrics.jsonl — iteration counts, finding categories, recurrent issues, Hard Rule candidates. Triggers: metrics, retrospective, iteration count, session summary, workflow health, metrics report. Use after multiple build or review sessions.

Bootstrap current project into devflow ecosystem — scaffold hard-rules.md and build directories. Use once per new project.

Refactor code for clarity, maintainability, or structure. Modes: --simplify (clean up changed code, delegates to code-simplifier agent), --extract (extract functions/classes to reduce duplication), --restructure (reorganize code across files). Runs tests before and after to ensure safety. Use when code works but needs improvement.

Respond to open PR review comments — reads all GitHub review threads, fixes each comment in parallel, posts replies. Use when addressing PR review feedback.

Adversarial PR review with 3-reviewer debate — Correctness, Architecture, DX reviewers challenge each other's findings before consolidation. Use when reviewing pull requests or code changes.

Shared review conventions — comment labels, dedup protocol, strengths, and PR size thresholds.

TypeScript code examples for all 12 review rules — good/bad patterns for reviewer reference.

Core 12-point review framework used across code-reviewer, build, and review agents.

Post-install setup for devflow plugin — installs devflow-engine dependencies (bun install) and runs a smoke test. Idempotent: detects what is already configured and skips those steps. Triggers: devflow-setup, /devflow-setup, devflow setup, bun install engine. Use after plugin install or reinstall. Do NOT use for project onboarding (use /onboard instead).

Completion macro skill — review + merge PR to close the loop. Trigger when user says "ship it", "let's merge this", "this is done", "code is complete", or when feature is finished and ready for final review. Trigger specifically at PR completion, not casual conversation.

Quick-start macro skill — bootstrap a project then run build in quick mode. Trigger when user says "start working on", "let's build this", "begin new project", or wants to quickly onboard then build without full ceremony.

Show active devflow workflow artifacts from the current session — artifact directories, current phase, and pending actions. Triggers: status, session status, active artifacts, current phase, workflow state.

Test quality patterns for frontend and backend testing. Triggers: writing tests, reviewing test code, generating tests, when tests fail, unit tests, E2E tests, test patterns. Covers Vitest/Jest, React Testing Library, Playwright, and backend API testing.

Generate unit or integration tests for source files or recent changes. Detects test framework (vitest/jest/bun/japa) from package.json and follows existing test conventions. Use when writing new tests, increasing coverage, or after implementing a feature. Spawns test-quality-reviewer agent to self-check output.