@techierathore/techieflow 1.0.0

package/opencode.jsonc

@@ -0,0 +1,929 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "instructions": [
+    ".tfcore/core-config.yaml",
+    ".tfcore/templates/v4custom/build-invocation-ladder.md",
+    ".tfcore/templates/v4custom/opencode-operating-contract.md",
+    "AGENTS.md"
+  ],
+  // Solo-dev TechieFlow v4: only the agents the compressed workflow actually uses.
+  // Stock story-flow agents (dev/pm/po/qa/sm/ux-expert) were trimmed 2026-06-12
+  // and are no longer included.
+  //
+  // NOTE on `tools` vs `permission`: the legacy `tools` key (e.g.
+  // {write/edit/bash: true}) is deprecated and auto-normalized to a `permission`
+  // block, and listing only three tools left read/grep/glob/task at their
+  // defaults anyway. We use `permission` explicitly so intent is unambiguous.
+  //
+  // NOTE on git/gh: "GIT IS MANUAL" is enforced here for OpenCode the same way
+  // `.claude/settings.json` + block-git.sh enforce it for Claude Code. Since
+  // 2026-08-21 (YOLO / goal mode, .tfcore/tasks/_yolo-mode.md) the permission
+  // map denies only git/gh WRITES (commit/push/add/reset/checkout/… and gh
+  // pr|issue|repo|release create/merge/close/…) — those are blocked in EVERY
+  // mode. READ-ONLY git/gh (status/log/diff/blame, gh pr list/view) is decided
+  // by the plugin-bridged block-git.sh: blocked outside YOLO, allowed in YOLO.
+  // The `rm */rmdir */sudo *` asks stay here; in YOLO the plugin's
+  // `permission.ask` hook auto-approves them (and `opencode run --auto`
+  // approves everything not denied). Verified at runtime (2026-08-20, OpenCode
+  // 1.18.18): compound forms like `cd x && git log` ARE caught — OpenCode
+  // tree-sitter-parses the command and checks each node.
+  // TWO FOOTGUNS (both proven, DECISIONS.md 2026-08-19 §7):
+  //   1. LAST matching rule wins. `"*": "allow"` must stay FIRST in every bash
+  //      map; written after the denies it silently disables them.
+  //   2. Agent-level `permission` rules are appended AFTER the root ruleset, so
+  //      a bare `"bash": "allow"` on an agent VOIDS the root git/gh denies for
+  //      that agent. Every agent below therefore repeats the full deny map —
+  //      never collapse it back to `"bash": "allow"`.
+  // Defense in depth: .opencode/plugin/techieflow.js additionally runs
+  // block-git.sh (throw = block) upstream of this permission check.
+  "permission": {
+    "bash": {
+      "*": "allow",
+      "git commit*": "deny",
+      "git push*": "deny",
+      "git add*": "deny",
+      "git rm*": "deny",
+      "git mv*": "deny",
+      "git reset*": "deny",
+      "git checkout*": "deny",
+      "git switch*": "deny",
+      "git restore*": "deny",
+      "git merge*": "deny",
+      "git rebase*": "deny",
+      "git cherry-pick*": "deny",
+      "git revert*": "deny",
+      "git clean*": "deny",
+      "git am*": "deny",
+      "git apply*": "deny",
+      "git init*": "deny",
+      "git clone*": "deny",
+      "git pull*": "deny",
+      "git fetch*": "deny",
+      "git filter-branch*": "deny",
+      "git filter-repo*": "deny",
+      "git gc*": "deny",
+      "git prune*": "deny",
+      "git update-ref*": "deny",
+      "git symbolic-ref*": "deny",
+      "git replace*": "deny",
+      "git update-index*": "deny",
+      "git commit-tree*": "deny",
+      "git write-tree*": "deny",
+      "git read-tree*": "deny",
+      "git fast-import*": "deny",
+      "git send-email*": "deny",
+      "git request-pull*": "deny",
+      "git svn*": "deny",
+      "gh pr create*": "deny",
+      "gh pr merge*": "deny",
+      "gh pr close*": "deny",
+      "gh pr edit*": "deny",
+      "gh pr comment*": "deny",
+      "gh pr review*": "deny",
+      "gh pr ready*": "deny",
+      "gh pr reopen*": "deny",
+      "gh pr lock*": "deny",
+      "gh pr unlock*": "deny",
+      "gh pr update-branch*": "deny",
+      "gh pr checkout*": "deny",
+      "gh issue create*": "deny",
+      "gh issue close*": "deny",
+      "gh issue edit*": "deny",
+      "gh issue comment*": "deny",
+      "gh issue delete*": "deny",
+      "gh issue reopen*": "deny",
+      "gh issue pin*": "deny",
+      "gh issue unpin*": "deny",
+      "gh issue lock*": "deny",
+      "gh issue unlock*": "deny",
+      "gh issue transfer*": "deny",
+      "gh issue develop*": "deny",
+      "gh repo create*": "deny",
+      "gh repo delete*": "deny",
+      "gh repo fork*": "deny",
+      "gh repo clone*": "deny",
+      "gh repo edit*": "deny",
+      "gh repo sync*": "deny",
+      "gh repo archive*": "deny",
+      "gh repo unarchive*": "deny",
+      "gh repo rename*": "deny",
+      "gh repo set-default*": "deny",
+      "gh repo deploy-key add*": "deny",
+      "gh repo deploy-key delete*": "deny",
+      "gh release create*": "deny",
+      "gh release delete*": "deny",
+      "gh release upload*": "deny",
+      "gh release edit*": "deny",
+      "gh workflow run*": "deny",
+      "gh workflow enable*": "deny",
+      "gh workflow disable*": "deny",
+      "gh run cancel*": "deny",
+      "gh run rerun*": "deny",
+      "gh run delete*": "deny",
+      "gh secret set*": "deny",
+      "gh secret delete*": "deny",
+      "gh variable set*": "deny",
+      "gh variable delete*": "deny",
+      "gh label create*": "deny",
+      "gh label delete*": "deny",
+      "gh label edit*": "deny",
+      "gh auth login*": "deny",
+      "gh auth logout*": "deny",
+      "gh auth refresh*": "deny",
+      "gh auth setup-git*": "deny",
+      "gh gist create*": "deny",
+      "gh gist delete*": "deny",
+      "gh gist edit*": "deny",
+      "gh ssh-key add*": "deny",
+      "gh gpg-key add*": "deny",
+      "gh cache delete*": "deny",
+      "rm *": "ask",
+      "rmdir *": "ask",
+      "sudo *": "ask"
+    }
+  },
+  "agent": {
+    "flow-master": {
+      "prompt": "{file:./.tfcore/agents/flow-master.md}",
+      "mode": "primary",
+      "permission": {
+        "edit": "allow",
+        "bash": {
+          "*": "allow",
+          "git commit*": "deny",
+          "git push*": "deny",
+          "git add*": "deny",
+          "git rm*": "deny",
+          "git mv*": "deny",
+          "git reset*": "deny",
+          "git checkout*": "deny",
+          "git switch*": "deny",
+          "git restore*": "deny",
+          "git merge*": "deny",
+          "git rebase*": "deny",
+          "git cherry-pick*": "deny",
+          "git revert*": "deny",
+          "git clean*": "deny",
+          "git am*": "deny",
+          "git apply*": "deny",
+          "git init*": "deny",
+          "git clone*": "deny",
+          "git pull*": "deny",
+          "git fetch*": "deny",
+          "git filter-branch*": "deny",
+          "git filter-repo*": "deny",
+          "git gc*": "deny",
+          "git prune*": "deny",
+          "git update-ref*": "deny",
+          "git symbolic-ref*": "deny",
+          "git replace*": "deny",
+          "git update-index*": "deny",
+          "git commit-tree*": "deny",
+          "git write-tree*": "deny",
+          "git read-tree*": "deny",
+          "git fast-import*": "deny",
+          "git send-email*": "deny",
+          "git request-pull*": "deny",
+          "git svn*": "deny",
+          "gh pr create*": "deny",
+          "gh pr merge*": "deny",
+          "gh pr close*": "deny",
+          "gh pr edit*": "deny",
+          "gh pr comment*": "deny",
+          "gh pr review*": "deny",
+          "gh pr ready*": "deny",
+          "gh pr reopen*": "deny",
+          "gh pr lock*": "deny",
+          "gh pr unlock*": "deny",
+          "gh pr update-branch*": "deny",
+          "gh pr checkout*": "deny",
+          "gh issue create*": "deny",
+          "gh issue close*": "deny",
+          "gh issue edit*": "deny",
+          "gh issue comment*": "deny",
+          "gh issue delete*": "deny",
+          "gh issue reopen*": "deny",
+          "gh issue pin*": "deny",
+          "gh issue unpin*": "deny",
+          "gh issue lock*": "deny",
+          "gh issue unlock*": "deny",
+          "gh issue transfer*": "deny",
+          "gh issue develop*": "deny",
+          "gh repo create*": "deny",
+          "gh repo delete*": "deny",
+          "gh repo fork*": "deny",
+          "gh repo clone*": "deny",
+          "gh repo edit*": "deny",
+          "gh repo sync*": "deny",
+          "gh repo archive*": "deny",
+          "gh repo unarchive*": "deny",
+          "gh repo rename*": "deny",
+          "gh repo set-default*": "deny",
+          "gh repo deploy-key add*": "deny",
+          "gh repo deploy-key delete*": "deny",
+          "gh release create*": "deny",
+          "gh release delete*": "deny",
+          "gh release upload*": "deny",
+          "gh release edit*": "deny",
+          "gh workflow run*": "deny",
+          "gh workflow enable*": "deny",
+          "gh workflow disable*": "deny",
+          "gh run cancel*": "deny",
+          "gh run rerun*": "deny",
+          "gh run delete*": "deny",
+          "gh secret set*": "deny",
+          "gh secret delete*": "deny",
+          "gh variable set*": "deny",
+          "gh variable delete*": "deny",
+          "gh label create*": "deny",
+          "gh label delete*": "deny",
+          "gh label edit*": "deny",
+          "gh auth login*": "deny",
+          "gh auth logout*": "deny",
+          "gh auth refresh*": "deny",
+          "gh auth setup-git*": "deny",
+          "gh gist create*": "deny",
+          "gh gist delete*": "deny",
+          "gh gist edit*": "deny",
+          "gh ssh-key add*": "deny",
+          "gh gpg-key add*": "deny",
+          "gh cache delete*": "deny",
+          "rm *": "ask",
+          "rmdir *": "ask",
+          "sudo *": "ask"
+        }
+      },
+      "description": "Madhav — the single super-agent. Orchestrates the full pipeline (*run-workflow, *phase) with parallel subagents, runs the unified build (*build-phase — calls /trblazeui + /techierag as sub-agents), fixes bugs from screenshots (*fix-issues), analyzes + logs human-found bugs without fixing (*triage-issues), records a single missed requirement in seconds (*log-miss), reports development telemetry (*metrics), and handles doc/status utilities (*render-workflow-docs, *generate-html, *handoff-phase, *refresh-status, *devguide) plus any one-off task."
+    },
+    "flow-architect": {
+      "prompt": "{file:./.tfcore/agents/architect.md}",
+      "mode": "all",
+      "permission": {
+        "edit": "allow",
+        "bash": {
+          "*": "allow",
+          "git commit*": "deny",
+          "git push*": "deny",
+          "git add*": "deny",
+          "git rm*": "deny",
+          "git mv*": "deny",
+          "git reset*": "deny",
+          "git checkout*": "deny",
+          "git switch*": "deny",
+          "git restore*": "deny",
+          "git merge*": "deny",
+          "git rebase*": "deny",
+          "git cherry-pick*": "deny",
+          "git revert*": "deny",
+          "git clean*": "deny",
+          "git am*": "deny",
+          "git apply*": "deny",
+          "git init*": "deny",
+          "git clone*": "deny",
+          "git pull*": "deny",
+          "git fetch*": "deny",
+          "git filter-branch*": "deny",
+          "git filter-repo*": "deny",
+          "git gc*": "deny",
+          "git prune*": "deny",
+          "git update-ref*": "deny",
+          "git symbolic-ref*": "deny",
+          "git replace*": "deny",
+          "git update-index*": "deny",
+          "git commit-tree*": "deny",
+          "git write-tree*": "deny",
+          "git read-tree*": "deny",
+          "git fast-import*": "deny",
+          "git send-email*": "deny",
+          "git request-pull*": "deny",
+          "git svn*": "deny",
+          "gh pr create*": "deny",
+          "gh pr merge*": "deny",
+          "gh pr close*": "deny",
+          "gh pr edit*": "deny",
+          "gh pr comment*": "deny",
+          "gh pr review*": "deny",
+          "gh pr ready*": "deny",
+          "gh pr reopen*": "deny",
+          "gh pr lock*": "deny",
+          "gh pr unlock*": "deny",
+          "gh pr update-branch*": "deny",
+          "gh pr checkout*": "deny",
+          "gh issue create*": "deny",
+          "gh issue close*": "deny",
+          "gh issue edit*": "deny",
+          "gh issue comment*": "deny",
+          "gh issue delete*": "deny",
+          "gh issue reopen*": "deny",
+          "gh issue pin*": "deny",
+          "gh issue unpin*": "deny",
+          "gh issue lock*": "deny",
+          "gh issue unlock*": "deny",
+          "gh issue transfer*": "deny",
+          "gh issue develop*": "deny",
+          "gh repo create*": "deny",
+          "gh repo delete*": "deny",
+          "gh repo fork*": "deny",
+          "gh repo clone*": "deny",
+          "gh repo edit*": "deny",
+          "gh repo sync*": "deny",
+          "gh repo archive*": "deny",
+          "gh repo unarchive*": "deny",
+          "gh repo rename*": "deny",
+          "gh repo set-default*": "deny",
+          "gh repo deploy-key add*": "deny",
+          "gh repo deploy-key delete*": "deny",
+          "gh release create*": "deny",
+          "gh release delete*": "deny",
+          "gh release upload*": "deny",
+          "gh release edit*": "deny",
+          "gh workflow run*": "deny",
+          "gh workflow enable*": "deny",
+          "gh workflow disable*": "deny",
+          "gh run cancel*": "deny",
+          "gh run rerun*": "deny",
+          "gh run delete*": "deny",
+          "gh secret set*": "deny",
+          "gh secret delete*": "deny",
+          "gh variable set*": "deny",
+          "gh variable delete*": "deny",
+          "gh label create*": "deny",
+          "gh label delete*": "deny",
+          "gh label edit*": "deny",
+          "gh auth login*": "deny",
+          "gh auth logout*": "deny",
+          "gh auth refresh*": "deny",
+          "gh auth setup-git*": "deny",
+          "gh gist create*": "deny",
+          "gh gist delete*": "deny",
+          "gh gist edit*": "deny",
+          "gh ssh-key add*": "deny",
+          "gh gpg-key add*": "deny",
+          "gh cache delete*": "deny",
+          "rm *": "ask",
+          "rmdir *": "ask",
+          "sudo *": "ask"
+        }
+      },
+      "description": "Optional deep architecture dive; /analyst covers day-1 architecture by default"
+    },
+    "flow-analyst": {
+      "prompt": "{file:./.tfcore/agents/analyst.md}",
+      "mode": "all",
+      "permission": {
+        "edit": "allow",
+        "bash": {
+          "*": "allow",
+          "git commit*": "deny",
+          "git push*": "deny",
+          "git add*": "deny",
+          "git rm*": "deny",
+          "git mv*": "deny",
+          "git reset*": "deny",
+          "git checkout*": "deny",
+          "git switch*": "deny",
+          "git restore*": "deny",
+          "git merge*": "deny",
+          "git rebase*": "deny",
+          "git cherry-pick*": "deny",
+          "git revert*": "deny",
+          "git clean*": "deny",
+          "git am*": "deny",
+          "git apply*": "deny",
+          "git init*": "deny",
+          "git clone*": "deny",
+          "git pull*": "deny",
+          "git fetch*": "deny",
+          "git filter-branch*": "deny",
+          "git filter-repo*": "deny",
+          "git gc*": "deny",
+          "git prune*": "deny",
+          "git update-ref*": "deny",
+          "git symbolic-ref*": "deny",
+          "git replace*": "deny",
+          "git update-index*": "deny",
+          "git commit-tree*": "deny",
+          "git write-tree*": "deny",
+          "git read-tree*": "deny",
+          "git fast-import*": "deny",
+          "git send-email*": "deny",
+          "git request-pull*": "deny",
+          "git svn*": "deny",
+          "gh pr create*": "deny",
+          "gh pr merge*": "deny",
+          "gh pr close*": "deny",
+          "gh pr edit*": "deny",
+          "gh pr comment*": "deny",
+          "gh pr review*": "deny",
+          "gh pr ready*": "deny",
+          "gh pr reopen*": "deny",
+          "gh pr lock*": "deny",
+          "gh pr unlock*": "deny",
+          "gh pr update-branch*": "deny",
+          "gh pr checkout*": "deny",
+          "gh issue create*": "deny",
+          "gh issue close*": "deny",
+          "gh issue edit*": "deny",
+          "gh issue comment*": "deny",
+          "gh issue delete*": "deny",
+          "gh issue reopen*": "deny",
+          "gh issue pin*": "deny",
+          "gh issue unpin*": "deny",
+          "gh issue lock*": "deny",
+          "gh issue unlock*": "deny",
+          "gh issue transfer*": "deny",
+          "gh issue develop*": "deny",
+          "gh repo create*": "deny",
+          "gh repo delete*": "deny",
+          "gh repo fork*": "deny",
+          "gh repo clone*": "deny",
+          "gh repo edit*": "deny",
+          "gh repo sync*": "deny",
+          "gh repo archive*": "deny",
+          "gh repo unarchive*": "deny",
+          "gh repo rename*": "deny",
+          "gh repo set-default*": "deny",
+          "gh repo deploy-key add*": "deny",
+          "gh repo deploy-key delete*": "deny",
+          "gh release create*": "deny",
+          "gh release delete*": "deny",
+          "gh release upload*": "deny",
+          "gh release edit*": "deny",
+          "gh workflow run*": "deny",
+          "gh workflow enable*": "deny",
+          "gh workflow disable*": "deny",
+          "gh run cancel*": "deny",
+          "gh run rerun*": "deny",
+          "gh run delete*": "deny",
+          "gh secret set*": "deny",
+          "gh secret delete*": "deny",
+          "gh variable set*": "deny",
+          "gh variable delete*": "deny",
+          "gh label create*": "deny",
+          "gh label delete*": "deny",
+          "gh label edit*": "deny",
+          "gh auth login*": "deny",
+          "gh auth logout*": "deny",
+          "gh auth refresh*": "deny",
+          "gh auth setup-git*": "deny",
+          "gh gist create*": "deny",
+          "gh gist delete*": "deny",
+          "gh gist edit*": "deny",
+          "gh ssh-key add*": "deny",
+          "gh gpg-key add*": "deny",
+          "gh cache delete*": "deny",
+          "rm *": "ask",
+          "rmdir *": "ask",
+          "sudo *": "ask"
+        }
+      },
+      "description": "Day-1 docs (*day1-brownfield / *day1-greenfield), UI mockups (*mockups), requirements split (*split-brd), doc amendments (*amend-docs), brainstorming, research"
+    },
+    "flow-verifier": {
+      "prompt": "{file:./.tfcore/agents/verifier.md}",
+      "mode": "all",
+      "permission": {
+        "edit": "allow",
+        "bash": {
+          "*": "allow",
+          "git commit*": "deny",
+          "git push*": "deny",
+          "git add*": "deny",
+          "git rm*": "deny",
+          "git mv*": "deny",
+          "git reset*": "deny",
+          "git checkout*": "deny",
+          "git switch*": "deny",
+          "git restore*": "deny",
+          "git merge*": "deny",
+          "git rebase*": "deny",
+          "git cherry-pick*": "deny",
+          "git revert*": "deny",
+          "git clean*": "deny",
+          "git am*": "deny",
+          "git apply*": "deny",
+          "git init*": "deny",
+          "git clone*": "deny",
+          "git pull*": "deny",
+          "git fetch*": "deny",
+          "git filter-branch*": "deny",
+          "git filter-repo*": "deny",
+          "git gc*": "deny",
+          "git prune*": "deny",
+          "git update-ref*": "deny",
+          "git symbolic-ref*": "deny",
+          "git replace*": "deny",
+          "git update-index*": "deny",
+          "git commit-tree*": "deny",
+          "git write-tree*": "deny",
+          "git read-tree*": "deny",
+          "git fast-import*": "deny",
+          "git send-email*": "deny",
+          "git request-pull*": "deny",
+          "git svn*": "deny",
+          "gh pr create*": "deny",
+          "gh pr merge*": "deny",
+          "gh pr close*": "deny",
+          "gh pr edit*": "deny",
+          "gh pr comment*": "deny",
+          "gh pr review*": "deny",
+          "gh pr ready*": "deny",
+          "gh pr reopen*": "deny",
+          "gh pr lock*": "deny",
+          "gh pr unlock*": "deny",
+          "gh pr update-branch*": "deny",
+          "gh pr checkout*": "deny",
+          "gh issue create*": "deny",
+          "gh issue close*": "deny",
+          "gh issue edit*": "deny",
+          "gh issue comment*": "deny",
+          "gh issue delete*": "deny",
+          "gh issue reopen*": "deny",
+          "gh issue pin*": "deny",
+          "gh issue unpin*": "deny",
+          "gh issue lock*": "deny",
+          "gh issue unlock*": "deny",
+          "gh issue transfer*": "deny",
+          "gh issue develop*": "deny",
+          "gh repo create*": "deny",
+          "gh repo delete*": "deny",
+          "gh repo fork*": "deny",
+          "gh repo clone*": "deny",
+          "gh repo edit*": "deny",
+          "gh repo sync*": "deny",
+          "gh repo archive*": "deny",
+          "gh repo unarchive*": "deny",
+          "gh repo rename*": "deny",
+          "gh repo set-default*": "deny",
+          "gh repo deploy-key add*": "deny",
+          "gh repo deploy-key delete*": "deny",
+          "gh release create*": "deny",
+          "gh release delete*": "deny",
+          "gh release upload*": "deny",
+          "gh release edit*": "deny",
+          "gh workflow run*": "deny",
+          "gh workflow enable*": "deny",
+          "gh workflow disable*": "deny",
+          "gh run cancel*": "deny",
+          "gh run rerun*": "deny",
+          "gh run delete*": "deny",
+          "gh secret set*": "deny",
+          "gh secret delete*": "deny",
+          "gh variable set*": "deny",
+          "gh variable delete*": "deny",
+          "gh label create*": "deny",
+          "gh label delete*": "deny",
+          "gh label edit*": "deny",
+          "gh auth login*": "deny",
+          "gh auth logout*": "deny",
+          "gh auth refresh*": "deny",
+          "gh auth setup-git*": "deny",
+          "gh gist create*": "deny",
+          "gh gist delete*": "deny",
+          "gh gist edit*": "deny",
+          "gh ssh-key add*": "deny",
+          "gh gpg-key add*": "deny",
+          "gh cache delete*": "deny",
+          "rm *": "ask",
+          "rmdir *": "ask",
+          "sudo *": "ask"
+        }
+      },
+      "description": "Vidur — autonomous verification (*verify ui|functional|all); writes verdicts into the checklist Requirements Status tables"
+    },
+    "trblazeui": {
+      "prompt": "You are the TrBlazeUI sub-agent. Read `.opencode/command/trblazeui.md` (fall back, in order, to `.claude/commands/trblazeui.md`, `.claude/trblazeui.md`, `.trblazeui/TrBlazeUI-AI-Reference.md`) and fully adopt that persona and its operating guidelines — it is the authoritative persona. NuGet credentials are user-level (Windows native `%AppData%\\NuGet\\NuGet.Config`, macOS/Linux `$HOME/.nuget/NuGet/NuGet.Config`, Docker `/root/.nuget/NuGet/NuGet.Config` from `%USERPROFILE%\\.opencode-docker\\nuget\\NuGet.Config`); never put a PAT in the repository. In Docker, never assume a Windows config is decryptable and never install `maui-tizen`; verify the mounted config and use the Docker build ladder. If neither file exists (TrBlazeUI NuGet not yet deployed), report the exact source/auth failure instead of blindly running `dotnet build`. Otherwise act as an expert .NET/Blazor developer specializing in the TrBlazeUI component library: build UI screens to match the approved mockups (`docs/{AppName}-UIDesign.md` + `docs/mockups/*.html`), follow `docs/{AppName}-Coding-Standards.md`, tag work with `[REQ-UI-N]` in the checklist Remarks, log TrBlazeUI gaps to `docs/{AppName}-TrBlazeUI-Feedback.md`. Never run git or gh.",
+      "mode": "all",
+      "permission": {
+        "edit": "allow",
+        "bash": {
+          "*": "allow",
+          "git commit*": "deny",
+          "git push*": "deny",
+          "git add*": "deny",
+          "git rm*": "deny",
+          "git mv*": "deny",
+          "git reset*": "deny",
+          "git checkout*": "deny",
+          "git switch*": "deny",
+          "git restore*": "deny",
+          "git merge*": "deny",
+          "git rebase*": "deny",
+          "git cherry-pick*": "deny",
+          "git revert*": "deny",
+          "git clean*": "deny",
+          "git am*": "deny",
+          "git apply*": "deny",
+          "git init*": "deny",
+          "git clone*": "deny",
+          "git pull*": "deny",
+          "git fetch*": "deny",
+          "git filter-branch*": "deny",
+          "git filter-repo*": "deny",
+          "git gc*": "deny",
+          "git prune*": "deny",
+          "git update-ref*": "deny",
+          "git symbolic-ref*": "deny",
+          "git replace*": "deny",
+          "git update-index*": "deny",
+          "git commit-tree*": "deny",
+          "git write-tree*": "deny",
+          "git read-tree*": "deny",
+          "git fast-import*": "deny",
+          "git send-email*": "deny",
+          "git request-pull*": "deny",
+          "git svn*": "deny",
+          "gh pr create*": "deny",
+          "gh pr merge*": "deny",
+          "gh pr close*": "deny",
+          "gh pr edit*": "deny",
+          "gh pr comment*": "deny",
+          "gh pr review*": "deny",
+          "gh pr ready*": "deny",
+          "gh pr reopen*": "deny",
+          "gh pr lock*": "deny",
+          "gh pr unlock*": "deny",
+          "gh pr update-branch*": "deny",
+          "gh pr checkout*": "deny",
+          "gh issue create*": "deny",
+          "gh issue close*": "deny",
+          "gh issue edit*": "deny",
+          "gh issue comment*": "deny",
+          "gh issue delete*": "deny",
+          "gh issue reopen*": "deny",
+          "gh issue pin*": "deny",
+          "gh issue unpin*": "deny",
+          "gh issue lock*": "deny",
+          "gh issue unlock*": "deny",
+          "gh issue transfer*": "deny",
+          "gh issue develop*": "deny",
+          "gh repo create*": "deny",
+          "gh repo delete*": "deny",
+          "gh repo fork*": "deny",
+          "gh repo clone*": "deny",
+          "gh repo edit*": "deny",
+          "gh repo sync*": "deny",
+          "gh repo archive*": "deny",
+          "gh repo unarchive*": "deny",
+          "gh repo rename*": "deny",
+          "gh repo set-default*": "deny",
+          "gh repo deploy-key add*": "deny",
+          "gh repo deploy-key delete*": "deny",
+          "gh release create*": "deny",
+          "gh release delete*": "deny",
+          "gh release upload*": "deny",
+          "gh release edit*": "deny",
+          "gh workflow run*": "deny",
+          "gh workflow enable*": "deny",
+          "gh workflow disable*": "deny",
+          "gh run cancel*": "deny",
+          "gh run rerun*": "deny",
+          "gh run delete*": "deny",
+          "gh secret set*": "deny",
+          "gh secret delete*": "deny",
+          "gh variable set*": "deny",
+          "gh variable delete*": "deny",
+          "gh label create*": "deny",
+          "gh label delete*": "deny",
+          "gh label edit*": "deny",
+          "gh auth login*": "deny",
+          "gh auth logout*": "deny",
+          "gh auth refresh*": "deny",
+          "gh auth setup-git*": "deny",
+          "gh gist create*": "deny",
+          "gh gist delete*": "deny",
+          "gh gist edit*": "deny",
+          "gh ssh-key add*": "deny",
+          "gh gpg-key add*": "deny",
+          "gh cache delete*": "deny",
+          "rm *": "ask",
+          "rmdir *": "ask",
+          "sudo *": "ask"
+        }
+      },
+      "description": "Expert .NET and Blazor developer specializing in the TrBlazeUI component library (REQ-UI-* builder). Use when integrating TrBlazeUI into existing Blazor applications, generating UI pages/components/layouts/forms/dashboards, theming, or any .NET/Blazor development with TrBlazeUI."
+    },
+    "techierag": {
+      "prompt": "You are the TechieRag sub-agent. Read `.opencode/command/techierag.md` (fall back, in order, to `.claude/commands/techierag.md`, `.claude/techierag.md`, `.techierag/TechieRag-AI-Reference.md`) and fully adopt that persona and its operating guidelines — it is the authoritative persona. NuGet credentials are user-level (Windows native `%AppData%\\NuGet\\NuGet.Config`, macOS/Linux `$HOME/.nuget/NuGet/NuGet.Config`, Docker `/root/.nuget/NuGet/NuGet.Config` from `%USERPROFILE%\\.opencode-docker\\nuget\\NuGet.Config`); never put a PAT in the repository. In Docker, never assume a Windows config is decryptable and never install `maui-tizen`; verify the mounted config and use the Docker build ladder. If neither file exists (TechieRag NuGet not yet deployed), report the exact source/auth failure instead of blindly running `dotnet build`. Otherwise act as an expert .NET developer specializing in the TechieRag RAG + LLM management library: wire RAG via `TechieRagBuilder` / `ITechieRag` (`IngestAsync`/`SearchAsync`/`AskAsync`/`ChatWithRagAsync`), add unit tests under `tests/unit/Rag/`, tag work with `[REQ-RAG-N]` in the checklist Remarks, log gaps to `docs/{AppName}-TechieRag-Feedback.md`. Never run git or gh.",
+      "mode": "all",
+      "permission": {
+        "edit": "allow",
+        "bash": {
+          "*": "allow",
+          "git commit*": "deny",
+          "git push*": "deny",
+          "git add*": "deny",
+          "git rm*": "deny",
+          "git mv*": "deny",
+          "git reset*": "deny",
+          "git checkout*": "deny",
+          "git switch*": "deny",
+          "git restore*": "deny",
+          "git merge*": "deny",
+          "git rebase*": "deny",
+          "git cherry-pick*": "deny",
+          "git revert*": "deny",
+          "git clean*": "deny",
+          "git am*": "deny",
+          "git apply*": "deny",
+          "git init*": "deny",
+          "git clone*": "deny",
+          "git pull*": "deny",
+          "git fetch*": "deny",
+          "git filter-branch*": "deny",
+          "git filter-repo*": "deny",
+          "git gc*": "deny",
+          "git prune*": "deny",
+          "git update-ref*": "deny",
+          "git symbolic-ref*": "deny",
+          "git replace*": "deny",
+          "git update-index*": "deny",
+          "git commit-tree*": "deny",
+          "git write-tree*": "deny",
+          "git read-tree*": "deny",
+          "git fast-import*": "deny",
+          "git send-email*": "deny",
+          "git request-pull*": "deny",
+          "git svn*": "deny",
+          "gh pr create*": "deny",
+          "gh pr merge*": "deny",
+          "gh pr close*": "deny",
+          "gh pr edit*": "deny",
+          "gh pr comment*": "deny",
+          "gh pr review*": "deny",
+          "gh pr ready*": "deny",
+          "gh pr reopen*": "deny",
+          "gh pr lock*": "deny",
+          "gh pr unlock*": "deny",
+          "gh pr update-branch*": "deny",
+          "gh pr checkout*": "deny",
+          "gh issue create*": "deny",
+          "gh issue close*": "deny",
+          "gh issue edit*": "deny",
+          "gh issue comment*": "deny",
+          "gh issue delete*": "deny",
+          "gh issue reopen*": "deny",
+          "gh issue pin*": "deny",
+          "gh issue unpin*": "deny",
+          "gh issue lock*": "deny",
+          "gh issue unlock*": "deny",
+          "gh issue transfer*": "deny",
+          "gh issue develop*": "deny",
+          "gh repo create*": "deny",
+          "gh repo delete*": "deny",
+          "gh repo fork*": "deny",
+          "gh repo clone*": "deny",
+          "gh repo edit*": "deny",
+          "gh repo sync*": "deny",
+          "gh repo archive*": "deny",
+          "gh repo unarchive*": "deny",
+          "gh repo rename*": "deny",
+          "gh repo set-default*": "deny",
+          "gh repo deploy-key add*": "deny",
+          "gh repo deploy-key delete*": "deny",
+          "gh release create*": "deny",
+          "gh release delete*": "deny",
+          "gh release upload*": "deny",
+          "gh release edit*": "deny",
+          "gh workflow run*": "deny",
+          "gh workflow enable*": "deny",
+          "gh workflow disable*": "deny",
+          "gh run cancel*": "deny",
+          "gh run rerun*": "deny",
+          "gh run delete*": "deny",
+          "gh secret set*": "deny",
+          "gh secret delete*": "deny",
+          "gh variable set*": "deny",
+          "gh variable delete*": "deny",
+          "gh label create*": "deny",
+          "gh label delete*": "deny",
+          "gh label edit*": "deny",
+          "gh auth login*": "deny",
+          "gh auth logout*": "deny",
+          "gh auth refresh*": "deny",
+          "gh auth setup-git*": "deny",
+          "gh gist create*": "deny",
+          "gh gist delete*": "deny",
+          "gh gist edit*": "deny",
+          "gh ssh-key add*": "deny",
+          "gh gpg-key add*": "deny",
+          "gh cache delete*": "deny",
+          "rm *": "ask",
+          "rmdir *": "ask",
+          "sudo *": "ask"
+        }
+      },
+      "description": "Expert .NET developer specializing in the TechieRag RAG + LLM management library (REQ-RAG-* builder). Use when integrating TechieRag into .NET applications - adding NuGet packages, configuring RAG pipelines, setting up LLM providers, implementing chat, tool calling, token tracking, and any AI/LLM feature powered by TechieRag."
+    }
+  },
+  "command": {
+    "techieflow:tasks:day1-brownfield": {
+      "template": "{file:./.tfcore/tasks/day1-brownfield.md}",
+      "description": "Day-1 master task for an EXISTING project: Architecture + BRD + Coding-Standards + .editorconfig + PROJECT-STATUS + CLAUDE.md + the screen-by-screen DevGuide (with per-screen screenshots) (+ one-Checklist migration if a dev plan exists), all HTML-rendered."
+    },
+    "techieflow:tasks:day1-greenfield": {
+      "template": "{file:./.tfcore/tasks/day1-greenfield.md}",
+      "description": "Day-1 master task for a NEW project: target Architecture + BRD + UI mockups + Coding-Standards + .editorconfig + PROJECT-STATUS + CLAUDE.md + UsageGuide, all HTML-rendered."
+    },
+    "techieflow:tasks:mockups": {
+      "template": "{file:./.tfcore/tasks/mockups.md}",
+      "description": "Greenfield UI design: docs/{App}-UIDesign.md (per-screen region→TrBlazeUI-control map) + rendered docs/mockups/*.html styled to look like TrBlazeUI. The build's visual contract + the verifier's visual baseline. Driven by /analyst."
+    },
+    "techieflow:tasks:split-brd": {
+      "template": "{file:./.tfcore/tasks/split-brd.md}",
+      "description": "Split the BRD into the one docs/{App}-Checklist.md (REQ-UI/FN/RAG/NFR-* in a single Requirements Status table)."
+    },
+    "techieflow:tasks:build-phase": {
+      "template": "{file:./.tfcore/tasks/build-phase.md}",
+      "description": "The single unified build: implement every open REQ (UI/FN/RAG/NFR) from the one Checklist by clustering and calling /trblazeui (from mockups) + /techierag as sub-agents; self-smoke (data + visual); chain the verifier. Driven by /flow-master."
+    },
+    "techieflow:tasks:fix-issues": {
+      "template": "{file:./.tfcore/tasks/fix-issues.md}",
+      "description": "Bug-fix front door: given a folder of screenshots (+ optional description), reproduce with Playwright, triage (layout/data/logic/RAG), fan fixes to the right builder, re-smoke (data+visual) + re-verify, update docs. Driven by /flow-master."
+    },
+    "techieflow:tasks:log-miss": {
+      "template": "{file:./.tfcore/tasks/log-miss.md}",
+      "description": "The 20-second front door for 'you missed this': turns one sentence about something an agent got wrong into a misses.jsonl record (what was missed, which phase/agent/model let it through, who found it) plus the checklist line — demotion with a dated miss Remark, or a new Planned row when nothing owns it. Never boots the app, never reproduces, never edits code. Driven by /flow-master."
+    },
+    "techieflow:tasks:triage-issues": {
+      "template": "{file:./.tfcore/tasks/triage-issues.md}",
+      "description": "ANALYZE-ONLY bug front door for human-found (UAT/production) bugs: reproduce with Playwright, triage to the owning REQ, log in the checklist (demote to Needs re-verify / new Planned rows), optional scoped regression re-verify, update PROJECT-STATUS with the *fix-issues pointer. NEVER edits code. Driven by /flow-master."
+    },
+    "techieflow:tasks:verify-phase": {
+      "template": "{file:./.tfcore/tasks/verify-phase.md}",
+      "description": "Autonomous verification of a scope (ui | functional | all | REQ list | legacy phase-N) — filters the one Checklist by REQ prefix; applies the data-render + visual-truth gates; verdicts land in the Checklist Requirements Status table."
+    },
+    "techieflow:tasks:handoff-phase": {
+      "template": "{file:./.tfcore/tasks/handoff-phase.md}",
+      "description": "Final wrap-up: UsageGuide doc (test users + test plan + setup), PROJECT-STATUS → Handoff, HTML re-renders, Library-Feedback consolidation."
+    },
+    "techieflow:tasks:refresh-status": {
+      "template": "{file:./.tfcore/tasks/refresh-status.md}",
+      "description": "RECOVERY: rebuild PROJECT-STATUS.md from ground truth (checklist tables + working-tree files + fresh build — NEVER git; git is manual) after a session died mid-phase and the status gate never ran. Distrusts stale status; never edits source."
+    },
+    "techieflow:tasks:metrics-report": {
+      "template": "{file:./.tfcore/tasks/metrics-report.md}",
+      "description": "Development telemetry report (*metrics): reads the append-only docs/metrics/ streams (runs / gates / sessions / commits / misses) and writes docs/metrics/METRICS.md + .html — first-pass rate, gate catch distribution, escape rate, rework ratio, throughput, commit cadence, plus the miss report (what was missed, which phase/agent/model let it through, what the fixes cost). NEVER prints a figure that pools live with backfilled records, or app with library/docs. Never runs git."
+    },
+    "techieflow:tasks:render-workflow-docs": {
+      "template": "{file:./.tfcore/tasks/render-workflow-docs.md}",
+      "description": "Re-render the canonical trio: BRD.html + Architecture.html + PROJECT-STATUS.html (with NEXT COMMAND call-to-action)."
+    },
+    "techieflow:tasks:generate-html": {
+      "template": "{file:./.tfcore/tasks/generate-html.md}",
+      "description": "Render any markdown file(s) or a non-recursive directory to self-contained HTML using the shared shell."
+    },
+    "techieflow:tasks:author-brd": {
+      "template": "{file:./.tfcore/tasks/author-brd.md}",
+      "description": "Interactively extend docs/{AppName}-BRD.md with confirmed BRD-N requirements (per-item elicitation)."
+    },
+    "techieflow:tasks:amend-docs": {
+      "template": "{file:./.tfcore/tasks/amend-docs.md}",
+      "description": "Fold an evolving concept / changed requirements into the EXISTING day-1 docs IN PLACE: surgically amends BRD + Architecture (append-only IDs), ripples to PROJECT-STATUS / BRD §4 / checklists, re-renders HTML. Incremental alternative to re-running day1-*."
+    },
+    "techieflow:tasks:productguide": {
+      "template": "{file:./.tfcore/tasks/productguide.md}",
+      "description": "End-user Product Guide: screenshot-illustrated, task-oriented how-to manual for external users (what each screen is for + how to do things) — the user-facing sibling of the DevGuide, reusing its captured screenshots. Always MD + HTML. On-demand. Driven by /flow-master."
+    },
+    "techieflow:tasks:devguide": {
+      "template": "{file:./.tfcore/tasks/devguide.md}",
+      "description": "Generate/refresh the screen-by-screen Developer Guide: traces every screen/control from Razor page → service → data-access → stored proc/query, per user role, documenting the code AS BUILT. Single doc for small apps, split per role for large ones; --update refreshes only changed screens."
+    },
+    "techieflow:tasks:document-project": {
+      "template": "{file:./.tfcore/tasks/document-project.md}",
+      "description": "Generate comprehensive documentation for existing projects optimized for AI development agents."
+    },
+    "techieflow:tasks:create-doc": {
+      "template": "{file:./.tfcore/tasks/create-doc.md}",
+      "description": "Create a document from a YAML-driven TechieFlow template (interactive, section by section)."
+    },
+    "techieflow:tasks:create-deep-research-prompt": {
+      "template": "{file:./.tfcore/tasks/create-deep-research-prompt.md}",
+      "description": "Generate well-structured research prompts."
+    },
+    "techieflow:tasks:facilitate-brainstorming-session": {
+      "template": "{file:./.tfcore/tasks/facilitate-brainstorming-session.md}",
+      "description": "Run a structured brainstorming session; results land in docs/brainstorming-session-results.md."
+    },
+    "techieflow:tasks:advanced-elicitation": {
+      "template": "{file:./.tfcore/tasks/advanced-elicitation.md}",
+      "description": "Reflective/brainstorming actions for deeper exploration and iterative refinement of drafted content."
+    },
+    "techieflow:tasks:execute-checklist": {
+      "template": "{file:./.tfcore/tasks/execute-checklist.md}",
+      "description": "Validate a document or work product against one of the TechieFlow checklists."
+    },
+    "techieflow:tasks:index-docs": {
+      "template": "{file:./.tfcore/tasks/index-docs.md}",
+      "description": "Maintain docs/index.md by scanning all documentation files and indexing them with descriptions."
+    },
+    "techieflow:tasks:kb-mode-interaction": {
+      "template": "{file:./.tfcore/tasks/kb-mode-interaction.md}",
+      "description": "User-friendly interface to the TechieFlow knowledge base."
+    },
+    "techieflow:tasks:shard-doc": {
+      "template": "{file:./.tfcore/tasks/shard-doc.md}",
+      "description": "Split a large document into smaller documents by level-2 sections, preserving content integrity."
+    }
+  }
+}