@pharaoh-so/mcp 0.3.14 → 0.3.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude-plugin/plugin.json +1 -1
- package/commands/plan.md +5 -0
- package/commands/review.md +5 -0
- package/dist/install-skills.d.ts +6 -2
- package/dist/install-skills.js +156 -42
- package/package.json +2 -1
- package/skills/brainstorm/SKILL.md +1 -1
- package/skills/plan/SKILL.md +26 -24
- package/skills/audit-tests/SKILL.md +0 -89
- package/skills/debt/SKILL.md +0 -34
- package/skills/execute/SKILL.md +0 -58
- package/skills/explore/SKILL.md +0 -33
- package/skills/finish/SKILL.md +0 -80
- package/skills/health/SKILL.md +0 -37
- package/skills/investigate/SKILL.md +0 -35
- package/skills/onboard/SKILL.md +0 -33
- package/skills/orchestrate/SKILL.md +0 -145
- package/skills/pr/SKILL.md +0 -53
- package/skills/review-codex/SKILL.md +0 -81
- package/skills/review-receive/SKILL.md +0 -82
- package/skills/wiring/SKILL.md +0 -35
- package/skills/worktree/SKILL.md +0 -86
package/skills/finish/SKILL.md
DELETED
|
@@ -1,80 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: finish
|
|
3
|
-
prompt-name: finish-branch
|
|
4
|
-
description: "Complete a development branch after implementation. Verify all tests pass, present structured options (merge locally, create PR, keep branch, or discard), execute the chosen workflow, and clean up worktrees. Never merge broken code or delete work without confirmation."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["git", "merge", "pull-request", "cleanup", "branch-management"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Finish Branch
|
|
12
|
-
|
|
13
|
-
Guide completion of development work after implementation is done. Verify tests, present options, execute choice, clean up.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
When implementation is complete and you need to decide how to integrate the work — merge, PR, keep, or discard.
|
|
18
|
-
|
|
19
|
-
## Process
|
|
20
|
-
|
|
21
|
-
### Step 1: Verify Tests
|
|
22
|
-
|
|
23
|
-
Run the full test suite before presenting options.
|
|
24
|
-
|
|
25
|
-
**If tests fail:** stop. Report failures. Do not proceed until tests pass.
|
|
26
|
-
|
|
27
|
-
**If tests pass:** continue.
|
|
28
|
-
|
|
29
|
-
### Step 2: Determine Base Branch
|
|
30
|
-
|
|
31
|
-
Check what branch this work split from (typically `main` or `master`).
|
|
32
|
-
|
|
33
|
-
### Step 3: Present Options
|
|
34
|
-
|
|
35
|
-
Present exactly these 4 options:
|
|
36
|
-
|
|
37
|
-
```
|
|
38
|
-
Implementation complete. What would you like to do?
|
|
39
|
-
|
|
40
|
-
1. Merge back to <base-branch> locally
|
|
41
|
-
2. Push and create a Pull Request
|
|
42
|
-
3. Keep the branch as-is (I'll handle it later)
|
|
43
|
-
4. Discard this work
|
|
44
|
-
|
|
45
|
-
Which option?
|
|
46
|
-
```
|
|
47
|
-
|
|
48
|
-
### Step 4: Execute Choice
|
|
49
|
-
|
|
50
|
-
**Option 1 — Merge locally:**
|
|
51
|
-
- Switch to base branch, pull latest, merge feature branch
|
|
52
|
-
- Verify tests on merged result
|
|
53
|
-
- Delete feature branch
|
|
54
|
-
|
|
55
|
-
**Option 2 — Create PR:**
|
|
56
|
-
- Push branch to remote
|
|
57
|
-
- Create PR with summary and test plan
|
|
58
|
-
- Keep worktree (may need it for review feedback)
|
|
59
|
-
|
|
60
|
-
**Option 3 — Keep as-is:**
|
|
61
|
-
- Report branch name and worktree path
|
|
62
|
-
- Don't clean up anything
|
|
63
|
-
|
|
64
|
-
**Option 4 — Discard:**
|
|
65
|
-
- List what will be deleted (branch, commits, worktree)
|
|
66
|
-
- Require typed "discard" confirmation before proceeding
|
|
67
|
-
- Delete branch and clean up worktree
|
|
68
|
-
|
|
69
|
-
### Step 5: Clean Up Worktree
|
|
70
|
-
|
|
71
|
-
For Options 1 and 4: remove the worktree after completing the action.
|
|
72
|
-
For Options 2 and 3: keep the worktree.
|
|
73
|
-
|
|
74
|
-
## Iron Rules
|
|
75
|
-
|
|
76
|
-
- Never proceed with failing tests
|
|
77
|
-
- Never merge without verifying tests on the merged result
|
|
78
|
-
- Never delete work without explicit confirmation
|
|
79
|
-
- Never force-push without explicit request
|
|
80
|
-
- Always present exactly 4 structured options — no open-ended questions
|
package/skills/health/SKILL.md
DELETED
|
@@ -1,37 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: health
|
|
3
|
-
prompt-name: health-check
|
|
4
|
-
description: "Full codebase health sweep using Pharaoh knowledge graph. Six-step pro-tier workflow: module map with metrics, dead code detection, test coverage gaps, duplicate logic, regression risk scoring, and spec drift analysis. Produces an A-F grade, top 5 risks, tech debt hotspots (high-complexity + low-coverage + high-volatility intersections), spec drift summary, and prioritized actions with effort estimates."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["health-check", "tech-debt", "architecture", "pharaoh", "test-coverage", "regression-risk", "spec-drift"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Health Check
|
|
12
|
-
|
|
13
|
-
Full codebase health sweep. Uses `health-check` — a 6-step pro-tier workflow that grades the codebase A-F, surfaces the top risks, maps tech debt hotspots, checks spec alignment, and produces prioritized actions. Requires Pro tools.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
Invoke when asked for a codebase health assessment, a technical debt overview, or a risk report. Use it at the start of a maintenance sprint, before a major refactor, or when the codebase has grown without systematic review.
|
|
18
|
-
|
|
19
|
-
## Workflow
|
|
20
|
-
|
|
21
|
-
1. Call `get_codebase_map` for the target repository with `include_metrics` to see all modules, their sizes, complexity, and volatility.
|
|
22
|
-
2. Call `get_unused_code` for the target repository to find dead exports and orphaned functions.
|
|
23
|
-
3. Call `get_test_coverage` for the target repository to identify modules and functions lacking tests.
|
|
24
|
-
4. Call `get_consolidation_opportunities` for the target repository to find duplicated logic across modules.
|
|
25
|
-
5. Call `get_regression_risk` for the target repository to assess which modules are most likely to break.
|
|
26
|
-
6. Call `get_vision_gaps` for the target repository to check spec-vs-code drift.
|
|
27
|
-
|
|
28
|
-
Iron law: Report what the data shows, not what you think should be true.
|
|
29
|
-
|
|
30
|
-
## Output
|
|
31
|
-
|
|
32
|
-
A health report containing:
|
|
33
|
-
- **Overall grade (A-F):** based on dead code volume, test coverage, duplication, regression risk, and spec alignment
|
|
34
|
-
- **Top 5 risks:** specific modules or functions, with data backing each risk
|
|
35
|
-
- **Tech debt hotspots:** high-complexity + low-coverage + high-volatility intersections
|
|
36
|
-
- **Spec drift:** what is specified but not built; what is built but not specified
|
|
37
|
-
- **Prioritized actions:** ordered by impact, each with effort estimate (small / medium / large)
|
|
@@ -1,35 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: investigate
|
|
3
|
-
prompt-name: investigate-change
|
|
4
|
-
description: "Full architectural context gathering before modifying a function, file, or module using Pharaoh knowledge graph. Four-step free-tier workflow: module structure, blast radius of downstream callers, related function discovery, and dependency mapping. Blocks code suggestions until all context is gathered. Produces an investigation report with structure, blast radius, related functions, dependency context, and risk assessment."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["investigation", "context-gathering", "blast-radius", "pharaoh", "architecture", "change-impact"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Investigate Change
|
|
12
|
-
|
|
13
|
-
Gather full architectural context before modifying anything. Uses `investigate-change` — a 4-step free-tier workflow that maps the target's structure, blast radius, related functions, and dependency context before any code suggestions are made.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
Invoke before modifying any function, file, or module — especially when the codebase is unfamiliar or when the change touches shared code. Use it to answer "what do I need to know before touching this?" without reading files one at a time.
|
|
18
|
-
|
|
19
|
-
## Workflow
|
|
20
|
-
|
|
21
|
-
1. Call `get_module_context` for the module containing the target to understand its structure and complexity.
|
|
22
|
-
2. Call `get_blast_radius` for the target to see every downstream caller and affected module.
|
|
23
|
-
3. Call `search_functions` for the target name to find related functions and potential naming conflicts.
|
|
24
|
-
4. Call `query_dependencies` to map how the containing module connects to the rest of the codebase.
|
|
25
|
-
|
|
26
|
-
Do NOT suggest any changes until all 4 queries complete.
|
|
27
|
-
|
|
28
|
-
## Output
|
|
29
|
-
|
|
30
|
-
An investigation report containing:
|
|
31
|
-
- **Current structure:** what the target does and where it lives
|
|
32
|
-
- **Blast radius:** every caller and module that would be affected by changes
|
|
33
|
-
- **Related functions:** similar names or overlapping behavior, potential naming conflicts
|
|
34
|
-
- **Dependency context:** how the module connects upstream and downstream
|
|
35
|
-
- **Risk assessment:** safe to change vs. high-risk paths, with specific reasons
|
package/skills/onboard/SKILL.md
DELETED
|
@@ -1,33 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: onboard
|
|
3
|
-
prompt-name: onboard-to-codebase
|
|
4
|
-
description: "Quick codebase orientation using Pharaoh knowledge graph. Five-step workflow using only free-tier tools: full module map, deep-dive into the three largest modules, entry point discovery, critical path blast radius, and core data flow mapping. Produces an onboarding summary with module descriptions, entry points, data flow, and key functions to read first."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["onboarding", "codebase-orientation", "architecture", "pharaoh", "module-map", "entry-points"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Onboard to Codebase
|
|
12
|
-
|
|
13
|
-
Quick orientation to an unfamiliar codebase. Uses `onboard-to-codebase` — a 5-step workflow using only free-tier Pharaoh tools to understand modules, entry points, data flow, and key functions without reading files one at a time.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
Invoke at the start of any session with an unfamiliar repository, or when asked to understand how a codebase is structured before making changes. Use it instead of exploring files manually.
|
|
18
|
-
|
|
19
|
-
## Workflow
|
|
20
|
-
|
|
21
|
-
1. Call `get_codebase_map` for the target repository to see all modules and their relationships.
|
|
22
|
-
2. For the 3 largest modules (by function count), call `get_module_context` to understand their internals.
|
|
23
|
-
3. Call `search_functions` with broad terms like "main", "init", "start", "handler" to find entry points.
|
|
24
|
-
4. Call `get_blast_radius` for the most-connected module to understand the critical path.
|
|
25
|
-
5. Call `query_dependencies` between the two most-connected modules to understand the core data flow.
|
|
26
|
-
|
|
27
|
-
## Output
|
|
28
|
-
|
|
29
|
-
An onboarding summary containing:
|
|
30
|
-
- **Module map:** what each module does, 1 sentence each
|
|
31
|
-
- **Entry points:** where execution starts, with function names and file paths
|
|
32
|
-
- **Core data flow:** how the main modules connect, with dependency directions
|
|
33
|
-
- **Key functions to read first:** highest connectivity or most-depended-on functions, with brief descriptions
|
|
@@ -1,145 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: orchestrate
|
|
3
|
-
prompt-name: orchestrate-plan
|
|
4
|
-
description: "Execute implementation plans by dispatching one subagent per task with two-stage review (spec compliance then code quality). Sequential task execution with quality gates. Controller stays in session, constructs focused context for each agent, never shares session history. Handles DONE/DONE_WITH_CONCERNS/NEEDS_CONTEXT/BLOCKED status protocol."
|
|
5
|
-
version: 0.2.5
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["subagents", "orchestration", "plan-execution", "quality-gates", "spec-review", "code-review"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Orchestrate Plan Execution
|
|
12
|
-
|
|
13
|
-
Execute a plan by dispatching a fresh subagent per task, with two-stage review after each: spec compliance first, then code quality. The controller (you) coordinates — subagents implement and review.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
- You have a written implementation plan with 2+ tasks
|
|
18
|
-
- Tasks are mostly independent (different files/modules)
|
|
19
|
-
- You want quality gates between tasks (not just fire-and-forget)
|
|
20
|
-
- You're staying in this session (not dispatching to parallel worktrees)
|
|
21
|
-
|
|
22
|
-
## When NOT to Use
|
|
23
|
-
|
|
24
|
-
- Tasks are tightly coupled (use manual execution)
|
|
25
|
-
- You want parallel execution across sessions (use `pharaoh:execute` instead)
|
|
26
|
-
- You don't have a plan yet (use `pharaoh:plan` first)
|
|
27
|
-
- You just need parallel dispatch without review gates (use `pharaoh:parallel`)
|
|
28
|
-
|
|
29
|
-
## Workflow
|
|
30
|
-
|
|
31
|
-
### Phase 0 — Setup
|
|
32
|
-
|
|
33
|
-
1. Read the plan file once. Extract all tasks with full text.
|
|
34
|
-
2. Note cross-task context: shared types, import paths, architectural constraints.
|
|
35
|
-
3. Create a task list tracking each task's status.
|
|
36
|
-
|
|
37
|
-
### Phase 1 — Per-Task Loop
|
|
38
|
-
|
|
39
|
-
For each task:
|
|
40
|
-
|
|
41
|
-
#### 1a. Dispatch Implementer
|
|
42
|
-
|
|
43
|
-
Launch a subagent with:
|
|
44
|
-
- **Full task text** (paste it, don't make the agent read the file)
|
|
45
|
-
- **Scene-setting context** (where this fits, what's already built, dependencies)
|
|
46
|
-
- **Constraints** (what NOT to change, scope boundaries)
|
|
47
|
-
- **Working directory**
|
|
48
|
-
|
|
49
|
-
The implementer should:
|
|
50
|
-
1. Ask questions before starting (don't guess)
|
|
51
|
-
2. Implement exactly what the task specifies
|
|
52
|
-
3. Write tests
|
|
53
|
-
4. Commit
|
|
54
|
-
5. Self-review
|
|
55
|
-
6. Report with status: **DONE** / **DONE_WITH_CONCERNS** / **NEEDS_CONTEXT** / **BLOCKED**
|
|
56
|
-
|
|
57
|
-
#### 1b. Handle Status
|
|
58
|
-
|
|
59
|
-
- **DONE** → proceed to spec review
|
|
60
|
-
- **DONE_WITH_CONCERNS** → read concerns. If correctness/scope issues, address before review. If observations, note and proceed.
|
|
61
|
-
- **NEEDS_CONTEXT** → provide missing information, re-dispatch
|
|
62
|
-
- **BLOCKED** → assess: provide more context, use a more capable model, break task smaller, or escalate to user
|
|
63
|
-
|
|
64
|
-
Never ignore an escalation. Never force retry without changes.
|
|
65
|
-
|
|
66
|
-
#### 1c. Spec Compliance Review
|
|
67
|
-
|
|
68
|
-
Dispatch a reviewer subagent with:
|
|
69
|
-
- Full task requirements (original spec text)
|
|
70
|
-
- Implementer's report of what they built
|
|
71
|
-
|
|
72
|
-
The spec reviewer must:
|
|
73
|
-
- Read actual code, not trust the report
|
|
74
|
-
- Check: missing requirements, extra/unneeded work, misinterpretations
|
|
75
|
-
- Verdict: **pass** or **issues found** (with file:line references)
|
|
76
|
-
|
|
77
|
-
If issues found → implementer fixes → spec reviewer re-reviews → repeat until pass.
|
|
78
|
-
|
|
79
|
-
#### 1d. Code Quality Review
|
|
80
|
-
|
|
81
|
-
Only after spec compliance passes. Dispatch a quality reviewer with:
|
|
82
|
-
- What was implemented
|
|
83
|
-
- Git SHAs (base and head)
|
|
84
|
-
- Task requirements
|
|
85
|
-
|
|
86
|
-
The quality reviewer checks:
|
|
87
|
-
- Single responsibility per file
|
|
88
|
-
- Clean interfaces and decomposition
|
|
89
|
-
- Test quality (assertions that verify behavior, not just coverage)
|
|
90
|
-
- Following existing codebase patterns
|
|
91
|
-
|
|
92
|
-
If issues found → implementer fixes → quality reviewer re-reviews → repeat until pass.
|
|
93
|
-
|
|
94
|
-
#### 1e. Mark Complete
|
|
95
|
-
|
|
96
|
-
Mark the task done. Move to next task.
|
|
97
|
-
|
|
98
|
-
### Phase 2 — Final Review
|
|
99
|
-
|
|
100
|
-
After all tasks complete, dispatch one final code reviewer across the entire implementation. Check for:
|
|
101
|
-
- Cross-task integration issues
|
|
102
|
-
- Consistency between tasks
|
|
103
|
-
- Overall architecture coherence
|
|
104
|
-
|
|
105
|
-
### Phase 3 — Finish
|
|
106
|
-
|
|
107
|
-
Use `pharaoh:finish` to decide: merge, PR, or cleanup.
|
|
108
|
-
|
|
109
|
-
## Model Selection
|
|
110
|
-
|
|
111
|
-
Match model capability to task complexity:
|
|
112
|
-
|
|
113
|
-
| Task type | Model tier |
|
|
114
|
-
|-----------|-----------|
|
|
115
|
-
| Isolated function, clear spec, 1-2 files | Fast/cheap |
|
|
116
|
-
| Multi-file integration, pattern matching | Standard |
|
|
117
|
-
| Architecture, design, review | Most capable |
|
|
118
|
-
|
|
119
|
-
## Prompt Quality
|
|
120
|
-
|
|
121
|
-
| Bad | Good |
|
|
122
|
-
|-----|------|
|
|
123
|
-
| "Implement the auth feature" | Full task text + context + constraints |
|
|
124
|
-
| Sharing session history | Constructing focused context per agent |
|
|
125
|
-
| "Fix it" | Specific report of what's wrong + file references |
|
|
126
|
-
| Skipping spec review | Always spec review before quality review |
|
|
127
|
-
|
|
128
|
-
## Iron Rules
|
|
129
|
-
|
|
130
|
-
- **One task at a time** — no parallel implementation (conflicts)
|
|
131
|
-
- **Never skip reviews** — spec compliance AND code quality, in that order
|
|
132
|
-
- **Spec before quality** — wrong order wastes review cycles
|
|
133
|
-
- **Construct context, don't inherit** — each agent gets exactly what it needs
|
|
134
|
-
- **Never trust reports** — reviewers read code, not claims
|
|
135
|
-
- **Fix before proceeding** — no moving to next task with open issues
|
|
136
|
-
- **Escalation is success** — BLOCKED/NEEDS_CONTEXT means the system is working
|
|
137
|
-
|
|
138
|
-
## Output
|
|
139
|
-
|
|
140
|
-
After all tasks complete:
|
|
141
|
-
- Summary of what was built (per task)
|
|
142
|
-
- Review findings that were caught and fixed
|
|
143
|
-
- Any concerns flagged by implementers
|
|
144
|
-
- Final reviewer assessment
|
|
145
|
-
- Ready for `pharaoh:finish`
|
package/skills/pr/SKILL.md
DELETED
|
@@ -1,53 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: pr
|
|
3
|
-
prompt-name: pre-pr-review
|
|
4
|
-
description: "Pre-pull-request architectural review checklist using Pharaoh codebase knowledge graph. Covers module context, blast radius per touched module, hidden coupling between modules, duplicate logic detection, regression risk scoring, and vision spec alignment. Produces a structured review summary before opening a PR."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["pull-request", "code-review", "architecture", "pharaoh", "pre-pr", "regression-risk"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Pre-PR Review
|
|
12
|
-
|
|
13
|
-
Architectural review checklist to run before opening a pull request. Uses `pre-pr-review` — a 6-step workflow covering module context, blast radius, dependency coupling, duplicate logic, regression risk, and spec drift. Catches architectural problems before reviewers see the code.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
Invoke before opening a pull request. Use it when changes touch one or more modules and you want a structured architectural assessment before requesting human review.
|
|
18
|
-
|
|
19
|
-
## Workflow
|
|
20
|
-
|
|
21
|
-
### Step 1: Module context
|
|
22
|
-
|
|
23
|
-
For each touched module, call `get_module_context` to review its current structure and complexity.
|
|
24
|
-
|
|
25
|
-
### Step 2: Blast radius
|
|
26
|
-
|
|
27
|
-
For each touched module, call `get_blast_radius` to identify what else is affected by the changes.
|
|
28
|
-
|
|
29
|
-
### Step 3: Dependency check
|
|
30
|
-
|
|
31
|
-
Call `query_dependencies` between each pair of touched modules to find hidden coupling introduced by the PR.
|
|
32
|
-
|
|
33
|
-
### Step 4: Consolidation check
|
|
34
|
-
|
|
35
|
-
Call `get_consolidation_opportunities` for the target repository to flag any duplicate logic introduced by the PR.
|
|
36
|
-
|
|
37
|
-
### Step 5: Regression risk
|
|
38
|
-
|
|
39
|
-
Call `get_regression_risk` for the target repository to assess overall change risk.
|
|
40
|
-
|
|
41
|
-
### Step 6: Vision alignment
|
|
42
|
-
|
|
43
|
-
Call `get_vision_gaps` for the target repository to check if changes align with or drift from specs.
|
|
44
|
-
|
|
45
|
-
## Output
|
|
46
|
-
|
|
47
|
-
A review summary containing:
|
|
48
|
-
- **Architecture impact:** modules affected, dependency changes introduced
|
|
49
|
-
- **Risk assessment:** blast radius per module, overall regression risk level
|
|
50
|
-
- **Cleanup opportunities:** consolidation candidates, unused code created
|
|
51
|
-
- **Spec alignment:** vision gaps introduced or resolved by the PR
|
|
52
|
-
|
|
53
|
-
Ready to paste into the PR description or share with reviewers.
|
|
@@ -1,81 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: review-codex
|
|
3
|
-
prompt-name: cross-model-review
|
|
4
|
-
description: "Cross-model security review. Dispatch code to a different AI model or subagent for independent second-opinion review. Evaluator applies AGREE, DISAGREE, or CONTEXT verdicts to each finding. Catches blind spots from single-model reasoning. Use for security-sensitive code, auth flows, data access, and architectural decisions."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["security-review", "cross-model", "second-opinion", "code-review", "verification"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Cross-Model Code Review
|
|
12
|
-
|
|
13
|
-
Get a second opinion on critical code by dispatching it to an independent reviewer — a different agent, model, or subagent. One model's blind spots are another's obvious catches.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
- Security-sensitive changes (auth, encryption, access control, token handling)
|
|
18
|
-
- Data access patterns (tenant isolation, query construction, input validation)
|
|
19
|
-
- Architectural decisions with long-term consequences
|
|
20
|
-
- Code you're not fully confident about
|
|
21
|
-
- Before shipping changes that affect user data or billing
|
|
22
|
-
|
|
23
|
-
## Do Not Use When
|
|
24
|
-
|
|
25
|
-
- Trivial changes (typos, formatting, dependency bumps)
|
|
26
|
-
- Changes fully covered by existing tests with high mutation scores
|
|
27
|
-
- Time-critical hotfixes where review delay is worse than risk
|
|
28
|
-
|
|
29
|
-
## Process
|
|
30
|
-
|
|
31
|
-
### 1. Prepare Review Package
|
|
32
|
-
|
|
33
|
-
Assemble exactly what the reviewer needs:
|
|
34
|
-
|
|
35
|
-
- **Changed files:** full diff or complete file contents
|
|
36
|
-
- **Context:** what the code does, why it was changed, what it interacts with
|
|
37
|
-
- **Constraints:** security requirements, isolation rules, performance bounds
|
|
38
|
-
- **Specific concerns:** what you want the reviewer to focus on
|
|
39
|
-
|
|
40
|
-
Do NOT send your session history — construct focused context.
|
|
41
|
-
|
|
42
|
-
### 2. Dispatch to Reviewer
|
|
43
|
-
|
|
44
|
-
Send the review package to an independent agent. The reviewer should have no knowledge of your reasoning process — they evaluate the code fresh.
|
|
45
|
-
|
|
46
|
-
### 3. Reviewer Applies Verdicts
|
|
47
|
-
|
|
48
|
-
For each finding, the reviewer assigns:
|
|
49
|
-
|
|
50
|
-
| Verdict | Meaning |
|
|
51
|
-
|---------|---------|
|
|
52
|
-
| **AGREE** | Confirms the implementation is correct for the stated concern |
|
|
53
|
-
| **DISAGREE** | Identifies a concrete issue with evidence |
|
|
54
|
-
| **CONTEXT** | Cannot determine correctness — needs more information |
|
|
55
|
-
|
|
56
|
-
Each DISAGREE must include: what's wrong, why it matters, and a suggested fix.
|
|
57
|
-
|
|
58
|
-
### 4. Evaluate Findings
|
|
59
|
-
|
|
60
|
-
When review returns:
|
|
61
|
-
|
|
62
|
-
- **AGREE items:** no action needed
|
|
63
|
-
- **DISAGREE items:** verify the finding against actual code. If confirmed, fix. If the reviewer misunderstood context, document why the current approach is correct.
|
|
64
|
-
- **CONTEXT items:** provide the missing information and re-review that item
|
|
65
|
-
|
|
66
|
-
## What to Include in Review
|
|
67
|
-
|
|
68
|
-
| Category | Include | Skip |
|
|
69
|
-
|----------|---------|------|
|
|
70
|
-
| Auth/access control | Token validation, session management, permission checks | UI styling |
|
|
71
|
-
| Data access | Query construction, tenant isolation, input sanitization | Logging format |
|
|
72
|
-
| Cryptography | Key management, encryption/decryption, hashing | String formatting |
|
|
73
|
-
| Error handling | What's exposed to users, what's logged, what's swallowed | Happy path only |
|
|
74
|
-
|
|
75
|
-
## Key Principles
|
|
76
|
-
|
|
77
|
-
- **Independent evaluation** — reviewer must not be primed with your conclusions
|
|
78
|
-
- **Evidence-based verdicts** — no "looks fine" without specifics
|
|
79
|
-
- **Verify disagreements** — reviewer may lack context; check before acting
|
|
80
|
-
- **Don't skip uncomfortable findings** — the point is catching what you missed
|
|
81
|
-
- **Repeat for high-stakes changes** — one review round may not be enough
|
|
@@ -1,82 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: review-receive
|
|
3
|
-
prompt-name: receive-code-review
|
|
4
|
-
description: "Receive code review feedback with technical rigor. No performative agreement — verify suggestions against codebase reality before implementing. Push back with evidence when feedback is wrong. Clarify all unclear items before implementing any. External feedback is suggestions to evaluate, not orders to follow."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["code-review", "feedback", "technical-rigor", "pushback", "collaboration"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Receiving Code Review
|
|
12
|
-
|
|
13
|
-
Code review requires technical evaluation, not emotional performance.
|
|
14
|
-
|
|
15
|
-
**Verify before implementing. Ask before assuming. Technical correctness over social comfort.**
|
|
16
|
-
|
|
17
|
-
## When to Use
|
|
18
|
-
|
|
19
|
-
When receiving code review feedback — from humans, external reviewers, or automated tools. Especially when feedback seems unclear or technically questionable.
|
|
20
|
-
|
|
21
|
-
## The Response Pattern
|
|
22
|
-
|
|
23
|
-
1. **READ:** complete feedback without reacting
|
|
24
|
-
2. **UNDERSTAND:** restate the requirement in your own words (or ask)
|
|
25
|
-
3. **VERIFY:** check against codebase reality
|
|
26
|
-
4. **EVALUATE:** technically sound for THIS codebase?
|
|
27
|
-
5. **RESPOND:** technical acknowledgment or reasoned pushback
|
|
28
|
-
6. **IMPLEMENT:** one item at a time, test each
|
|
29
|
-
|
|
30
|
-
## Forbidden Responses
|
|
31
|
-
|
|
32
|
-
Never respond with:
|
|
33
|
-
- "You're absolutely right!"
|
|
34
|
-
- "Great point!" / "Excellent feedback!"
|
|
35
|
-
- "Let me implement that now" (before verification)
|
|
36
|
-
- Any gratitude expression
|
|
37
|
-
|
|
38
|
-
Instead: restate the technical requirement, ask clarifying questions, push back with evidence if wrong, or just start fixing.
|
|
39
|
-
|
|
40
|
-
## Handling Unclear Feedback
|
|
41
|
-
|
|
42
|
-
If ANY item is unclear: **stop — do not implement anything yet.** Ask for clarification on unclear items before touching code. Items may be related; partial understanding produces wrong implementations.
|
|
43
|
-
|
|
44
|
-
## Evaluating External Feedback
|
|
45
|
-
|
|
46
|
-
Before implementing suggestions from external reviewers:
|
|
47
|
-
|
|
48
|
-
1. Is this technically correct for THIS codebase?
|
|
49
|
-
2. Does it break existing functionality?
|
|
50
|
-
3. Is there a reason for the current implementation?
|
|
51
|
-
4. Does the reviewer understand the full context?
|
|
52
|
-
5. Does it conflict with prior architectural decisions?
|
|
53
|
-
|
|
54
|
-
If a suggestion seems wrong, push back with technical reasoning — reference working tests, actual code, or codebase patterns.
|
|
55
|
-
|
|
56
|
-
## When to Push Back
|
|
57
|
-
|
|
58
|
-
- Suggestion breaks existing functionality
|
|
59
|
-
- Reviewer lacks full context
|
|
60
|
-
- Feature is unused (YAGNI)
|
|
61
|
-
- Technically incorrect for this stack
|
|
62
|
-
- Conflicts with established architectural decisions
|
|
63
|
-
|
|
64
|
-
**How:** technical reasoning, specific questions, references to working code. Never defensive — just factual.
|
|
65
|
-
|
|
66
|
-
## Implementation Order
|
|
67
|
-
|
|
68
|
-
For multi-item feedback:
|
|
69
|
-
|
|
70
|
-
1. Clarify anything unclear FIRST
|
|
71
|
-
2. Implement in priority order: blocking issues, simple fixes, complex fixes
|
|
72
|
-
3. Test each fix individually
|
|
73
|
-
4. Verify no regressions
|
|
74
|
-
|
|
75
|
-
## Acknowledging Correct Feedback
|
|
76
|
-
|
|
77
|
-
When feedback IS correct:
|
|
78
|
-
- "Fixed. [Brief description of what changed]"
|
|
79
|
-
- "Good catch — [specific issue]. Fixed in [location]."
|
|
80
|
-
- Or just fix it silently — the code shows you heard.
|
|
81
|
-
|
|
82
|
-
Actions speak. No performative agreement needed.
|
package/skills/wiring/SKILL.md
DELETED
|
@@ -1,35 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: wiring
|
|
3
|
-
prompt-name: validate-wiring
|
|
4
|
-
description: "Wiring validation for a codebase module using Pharaoh knowledge graph. Four-step pro-tier workflow: entry point reachability, caller verification via blast radius, test coverage per function, and dead code detection. Categorizes functions as CONNECTED, UNREACHABLE, DEAD, or UNTESTED. Produces a PASS or FAIL verdict with specific issues listed. Iron law: zero callers on a non-entry-point export means the code is not wired."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["wiring", "reachability", "dead-code", "pharaoh", "test-coverage", "entry-points", "validation"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Validate Wiring
|
|
12
|
-
|
|
13
|
-
Verify that code in a module is properly connected. Uses `validate-wiring` — a 4-step pro-tier workflow that checks reachability from entry points, verifies functions have callers, confirms test coverage, and detects dead code. Produces a PASS / FAIL verdict with categorized findings. Requires Pro tools.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
Invoke after adding new exports or functions, before merging code that adds a new module, or when dead code is suspected. Use it to answer "is this code actually being used?" with data instead of guesswork.
|
|
18
|
-
|
|
19
|
-
## Workflow
|
|
20
|
-
|
|
21
|
-
1. Call `check_reachability` for the target module to verify all exports are reachable from production entry points.
|
|
22
|
-
2. Call `get_blast_radius` for the target module to verify functions have callers.
|
|
23
|
-
3. Call `get_test_coverage` for the target module to check which functions are tested.
|
|
24
|
-
4. Call `get_unused_code` for the target module to detect any dead code.
|
|
25
|
-
|
|
26
|
-
Iron law: Zero callers on a non-entry-point export = the code is not wired.
|
|
27
|
-
|
|
28
|
-
## Output
|
|
29
|
-
|
|
30
|
-
A wiring report containing:
|
|
31
|
-
- **CONNECTED:** Functions reachable from entry points with test coverage
|
|
32
|
-
- **UNREACHABLE:** Exports with no path from entry points
|
|
33
|
-
- **DEAD:** Functions with zero callers (not entry points)
|
|
34
|
-
- **UNTESTED:** Reachable functions lacking test coverage
|
|
35
|
-
- **Verdict:** PASS (all exports wired and tested) or FAIL (with specific issues listed and recommended actions)
|
package/skills/worktree/SKILL.md
DELETED
|
@@ -1,86 +0,0 @@
|
|
|
1
|
-
---
|
|
2
|
-
name: worktree
|
|
3
|
-
prompt-name: git-worktree
|
|
4
|
-
description: "Set up isolated git worktrees for feature work. Smart directory selection with safety verification — checks for existing worktree directories, verifies gitignore, auto-detects project setup, and confirms clean test baseline before starting. Prevents accidentally committing worktree contents."
|
|
5
|
-
version: 0.2.0
|
|
6
|
-
homepage: https://pharaoh.so
|
|
7
|
-
user-invocable: true
|
|
8
|
-
metadata: {"emoji": "☥", "tags": ["git", "worktree", "isolation", "branching", "workspace"]}
|
|
9
|
-
---
|
|
10
|
-
|
|
11
|
-
# Git Worktrees
|
|
12
|
-
|
|
13
|
-
Create isolated workspaces sharing the same repository. Work on multiple branches simultaneously without switching.
|
|
14
|
-
|
|
15
|
-
## When to Use
|
|
16
|
-
|
|
17
|
-
Before starting feature work that needs isolation from the current workspace. Before executing implementation plans. Any time you need a clean branch without disturbing current work.
|
|
18
|
-
|
|
19
|
-
## Directory Selection
|
|
20
|
-
|
|
21
|
-
Follow this priority order:
|
|
22
|
-
|
|
23
|
-
1. **Check existing directories:** look for `.worktrees/` or `worktrees/` in the project root. If both exist, `.worktrees/` wins.
|
|
24
|
-
2. **Check project docs:** look for worktree directory preferences in CLAUDE.md or project config.
|
|
25
|
-
3. **Ask the user:** if no directory exists and no preference is documented.
|
|
26
|
-
|
|
27
|
-
## Safety Verification
|
|
28
|
-
|
|
29
|
-
For project-local worktree directories:
|
|
30
|
-
|
|
31
|
-
```bash
|
|
32
|
-
git check-ignore -q .worktrees 2>/dev/null
|
|
33
|
-
```
|
|
34
|
-
|
|
35
|
-
If the directory is NOT gitignored: add it to `.gitignore` and commit before creating worktrees. This prevents accidentally committing worktree contents to the repository.
|
|
36
|
-
|
|
37
|
-
Global directories (outside the project) don't need this check.
|
|
38
|
-
|
|
39
|
-
## Creation Steps
|
|
40
|
-
|
|
41
|
-
### 1. Create Worktree
|
|
42
|
-
|
|
43
|
-
```bash
|
|
44
|
-
git worktree add <path>/<branch-name> -b <branch-name>
|
|
45
|
-
cd <path>/<branch-name>
|
|
46
|
-
```
|
|
47
|
-
|
|
48
|
-
### 2. Install Dependencies
|
|
49
|
-
|
|
50
|
-
Auto-detect from project files:
|
|
51
|
-
|
|
52
|
-
| File | Command |
|
|
53
|
-
|------|---------|
|
|
54
|
-
| `package.json` + `pnpm-lock.yaml` | `pnpm install` |
|
|
55
|
-
| `package.json` | `npm install` |
|
|
56
|
-
| `Cargo.toml` | `cargo build` |
|
|
57
|
-
| `requirements.txt` | `pip install -r requirements.txt` |
|
|
58
|
-
| `go.mod` | `go mod download` |
|
|
59
|
-
|
|
60
|
-
### 3. Verify Clean Baseline
|
|
61
|
-
|
|
62
|
-
Run the project's test suite. If tests fail, report failures and ask whether to proceed or investigate. Don't start work on a broken baseline.
|
|
63
|
-
|
|
64
|
-
### 4. Report
|
|
65
|
-
|
|
66
|
-
```
|
|
67
|
-
Worktree ready at <full-path>
|
|
68
|
-
Tests passing (<N> tests, 0 failures)
|
|
69
|
-
Ready to implement <feature-name>
|
|
70
|
-
```
|
|
71
|
-
|
|
72
|
-
## Common Mistakes
|
|
73
|
-
|
|
74
|
-
| Mistake | Fix |
|
|
75
|
-
|---------|-----|
|
|
76
|
-
| Skipping gitignore verification | Always check before creating project-local worktrees |
|
|
77
|
-
| Assuming directory location | Follow priority: existing > docs > ask |
|
|
78
|
-
| Proceeding with failing baseline tests | Report failures, get permission first |
|
|
79
|
-
| Hardcoding setup commands | Auto-detect from project files |
|
|
80
|
-
|
|
81
|
-
## Red Flags
|
|
82
|
-
|
|
83
|
-
- Never create a worktree without verifying it's gitignored (project-local)
|
|
84
|
-
- Never skip baseline test verification
|
|
85
|
-
- Never proceed with failing tests without asking
|
|
86
|
-
- Never assume directory location when ambiguous
|