gentyr 1.3.0

package/.claude/commands/overdrive-gentyr.md

@@ -0,0 +1,167 @@
+<!-- HOOK:GENTYR:overdrive -->
+# /overdrive-gentyr - GENTYR Overdrive Mode
+
+Activates overdrive mode for 1 hour, maxing out all automation frequencies for rapid iteration. The usage optimizer is paused during overdrive to prevent it from scaling frequencies back.
+
+The prefetch hook has pre-gathered the current automation config and injected it as `[PREFETCH:overdrive]` context above. Use that data for Step 1 instead of reading the file. If the prefetch data is missing, read the file directly.
+
+## What This Does
+
+Overdrive temporarily sets all automation cooldowns to their minimum useful values:
+
+| Automation | Default | Overdrive |
+|-----------|---------|-----------|
+| hourly_tasks | 55 min | 10 min |
+| lint_checker | 30 min | 10 min |
+| task_runner | 60 min | 10 min |
+| todo_maintenance | 15 min | 5 min |
+| antipattern_hunter | 360 min | 60 min |
+| standalone_antipattern_hunter | 180 min | 60 min |
+| standalone_compliance_checker | 60 min | 15 min |
+| preview_promotion | 360 min | 60 min |
+| staging_health_monitor | 180 min | 30 min |
+| production_health_monitor | 60 min | 15 min |
+| user_feedback | 120 min | 30 min |
+| schema_mapper | 1440 min | 120 min |
+| triage_per_item | 60 min | 15 min |
+| test_failure_reporter | 120 min | 30 min |
+| compliance_checker_file | 10080 min | 1440 min |
+| compliance_checker_spec | 10080 min | 1440 min |
+
+**Unchanged (at floor or stability-gated):**
+- `triage_check`: 5 min (already at floor)
+- `pre_commit_review`: 5 min (already at floor)
+- `staging_promotion`: 1200 min (24h stability gate)
+
+**Concurrency:** MAX_CONCURRENT_AGENTS raised from 5 to 8.
+
+## What This Preserves
+
+- CTO activity gate (24h briefing requirement) - NOT bypassed
+- `enabled: false` automation toggle - NOT bypassed
+- Staging-to-production promotion 24h stability gate - NOT changed
+
+## Flow
+
+### Step 1: Read Current State
+
+Read `.claude/state/automation-config.json` and check if `overdrive` section exists and is active.
+
+### Step 2: Handle Current State
+
+**If overdrive is active and NOT expired:**
+
+Display current overdrive status:
+```
+OVERDRIVE MODE: ACTIVE
+Activated: {activated_at}
+Expires: {expires_at} ({minutes remaining} min remaining)
+Concurrency: {max_concurrent_override} agents
+Factor frozen at: {previous_state.factor}
+```
+
+Use `AskUserQuestion`:
+- **Question:** "Overdrive is currently active. What would you like to do?"
+- **Header:** "Overdrive"
+- **Options:**
+  - "Extend +60 minutes" - Push expiry forward by 1 hour
+  - "Deactivate now" - Revert to previous state immediately
+  - "Show status only" - Just display current state
+
+If "Extend +60 minutes":
+- Read the config, update `overdrive.expires_at` to current `expires_at` + 60 minutes
+- Write the config back
+- Display new expiry time
+
+If "Deactivate now":
+- Read the config
+- Restore `config.effective = config.overdrive.previous_state.effective`
+- Restore `config.adjustment.factor = config.overdrive.previous_state.factor`
+- Set `config.overdrive.active = false`
+- Write config
+- Display "Overdrive deactivated. Previous cooldowns restored."
+
+**If overdrive is active but EXPIRED:**
+
+Display: "Overdrive was active but has expired. It will be auto-reverted on the next optimizer cycle."
+Then treat as inactive (offer activation).
+
+**If overdrive is inactive (or no overdrive section):**
+
+Display current automation state summary, then use `AskUserQuestion`:
+- **Question:** "Activate overdrive mode? All automation frequencies will be maxed for 1 hour."
+- **Header:** "Overdrive"
+- **Options:**
+  - "Activate overdrive (1 hour)" (Recommended)
+  - "Cancel"
+
+### Step 3: Activate Overdrive
+
+If user confirms activation:
+
+1. Read `.claude/state/automation-config.json`
+2. Save current state:
+   ```json
+   {
+     "overdrive": {
+       "active": true,
+       "activated_at": "<ISO now>",
+       "expires_at": "<ISO now + 1 hour>",
+       "previous_state": {
+         "factor": "<current config.adjustment.factor or 1.0>",
+         "effective": "<current config.effective or {}>"
+       },
+       "max_concurrent_override": 8,
+       "overdrive_effective": {
+         "triage_check": 5,
+         "hourly_tasks": 10,
+         "lint_checker": 10,
+         "task_runner": 10,
+         "todo_maintenance": 5,
+         "antipattern_hunter": 60,
+         "standalone_antipattern_hunter": 60,
+         "standalone_compliance_checker": 15,
+         "preview_promotion": 60,
+         "staging_promotion": 1200,
+         "staging_health_monitor": 30,
+         "production_health_monitor": 15,
+         "user_feedback": 30,
+         "schema_mapper": 120,
+         "triage_per_item": 15,
+         "test_failure_reporter": 30,
+         "pre_commit_review": 5,
+         "compliance_checker_file": 1440,
+         "compliance_checker_spec": 1440
+       }
+     }
+   }
+   ```
+3. Set `config.effective` to the overdrive values
+4. Write the config
+
+### Step 4: Display Summary
+
+```
+OVERDRIVE ACTIVATED
+
+Duration: 1 hour (expires at {expires_at})
+Concurrency: 5 -> 8 agents
+Previous factor: {factor} (will be restored on expiry)
+
+Key changes:
+  hourly_tasks:    55 min -> 10 min
+  task_runner:     60 min -> 10 min
+  antipattern:    360 min -> 60 min
+  compliance:   10080 min -> 1440 min
+
+The usage optimizer will NOT adjust cooldowns during overdrive.
+Overdrive will auto-revert when it expires.
+To deactivate early: /overdrive-gentyr
+```
+
+## Implementation Notes
+
+- The config file is at `.claude/state/automation-config.json`
+- Use `fs.readFileSync` and `fs.writeFileSync` to read/write
+- Always ensure the `version: 1` field is preserved in the config
+- If config file doesn't exist, create it with version: 1 and the overdrive section

package/.claude/commands/product-manager.md

@@ -0,0 +1,32 @@
+<!-- HOOK:GENTYR:product-manager -->
+# /product-manager - Product Market Fit Analysis
+
+Manage the product-market-fit (PMF) analysis pipeline. This command shows current analysis status and provides options to initiate, view, run, or report on the analysis.
+
+## Step 1: Show Current Status
+
+Call `mcp__product-manager__get_analysis_status()` and display:
+- Overall status (not_started / pending_approval / approved / in_progress / completed)
+- Section progress: show each section with a check mark (populated) or circle (empty)
+- If completed: show compliance stats (mapped/total pain points)
+
+## Step 2: Present Options Based on Status
+
+### If status is `not_started`:
+Present these options:
+1. **Initiate analysis** - Call `mcp__product-manager__initiate_analysis({initiated_by: "human"})`, then report to deputy-CTO via `mcp__agent-reports__report_to_deputy_cto({title: "PMF Analysis Initiated", category: "decision", priority: "high", content: "A product-market-fit analysis has been initiated and requires your approval. Call mcp__product-manager__approve_analysis to approve."})`
+
+### If status is `pending_approval`:
+Show message: "Analysis is awaiting CTO approval. The deputy-CTO will approve during the next triage cycle."
+Option: **Approve now** (if CTO is running this command) - Call `mcp__product-manager__approve_analysis({approved_by: "human"})`
+
+### If status is `approved` or `in_progress`:
+Present these options:
+1. **View section** - Ask which section (1-6), then call `mcp__product-manager__read_section({section: N})`
+2. **Run full pipeline** - Call `mcp__product-manager__clear_and_respawn({initiated_by: "human"})` to wipe and rebuild all sections sequentially via task chain
+3. **Regenerate markdown** - Call `mcp__product-manager__regenerate_md()`
+
+### If status is `completed`:
+Present all options above plus:
+4. **Persona compliance** - Call `mcp__product-manager__get_compliance_report()` and display results
+5. **List unmapped pain points** - Call `mcp__product-manager__list_pain_points({unmapped_only: true})`

package/.claude/commands/push-migrations.md

@@ -0,0 +1,86 @@
+<!-- HOOK:GENTYR:push-migrations -->
+# /push-migrations - Push Local Database Migrations to Remote Supabase
+
+Apply pending local migration files to the remote Supabase database. This is the MCP-native equivalent of `supabase link && supabase db push`.
+
+The prefetch hook has pre-gathered local migration files and injected them as `[PREFETCH:push-migrations]` context above. Use that data for Step 0/Step 2 instead of reading the filesystem. If the prefetch data is missing, read the files directly.
+
+## Security Notes
+
+- Each migration is executed via `supabase_push_migration` which requires **APPROVE DATABASE** CTO approval
+- Migrations are tracked in `supabase_migrations.schema_migrations` — already-applied migrations are skipped
+- Failed migrations are automatically rolled back by the Supabase Management API
+- Requires `SUPABASE_ACCESS_TOKEN` (management API token) to be set
+
+## Push Flow
+
+### Step 0: Load Configuration
+
+Read `.claude/config/services.json` and use the `supabase.migrationsDir` field for the local migration file path.
+
+If the file does not exist or `supabase.migrationsDir` is not set:
+1. Use `AskUserQuestion` to ask: "Where are your Supabase migration files? (relative path from project root)"
+2. Provide common options:
+   - Option 1: "supabase/migrations/" — Standard Supabase CLI layout
+   - Option 2: "database/migrations/" — Alternative layout
+3. Save the path to `.claude/config/services.json` (create file if needed)
+
+### Step 1: List Remote Migrations
+
+Call `mcp__supabase__supabase_list_migrations` to get the list of already-applied migrations on the remote database.
+
+Display the results to the user showing which migrations have been applied.
+
+### Step 2: Read Local Migration Files
+
+Read the local migration directory (from config) and list all `.sql` files, sorted by name (which sorts by number prefix).
+
+Naming convention: `NNN_description.sql` (e.g., `001_initial_schema.sql`)
+
+### Step 3: Identify Pending Migrations
+
+Compare local files against remote migrations. A migration is pending if its name/version does not appear in the remote migration list.
+
+Display to the user:
+- Already applied: `001_initial_schema.sql`, etc.
+- Pending: `004_new_feature.sql`, etc.
+
+If no pending migrations, inform the user and stop.
+
+### Step 4: Confirm with User
+
+Use `AskUserQuestion` to confirm:
+
+**Question:** "Push {N} pending migration(s) to remote Supabase? This will execute SQL against the production database."
+
+**Header:** "Migrations"
+
+**Options:**
+- Option 1: "Push all pending" — apply all pending migrations in order
+- Option 2: "Show SQL first" — display the SQL content of each pending migration before pushing
+- Option 3: "Cancel" — abort without changes
+
+### Step 5: Push Each Pending Migration
+
+For each pending migration (in order):
+
+1. Read the local `.sql` file content
+2. Call `mcp__supabase__supabase_push_migration` with:
+   - `name`: The migration filename without `.sql` extension (e.g., `004_new_feature`)
+   - `sql`: The full SQL content of the file
+3. Report success or failure for each migration
+4. **STOP on first failure** — do not continue with subsequent migrations
+
+### Step 6: Verify
+
+Call `mcp__supabase__supabase_list_migrations` again to confirm all pending migrations now appear as applied.
+
+Report final status to the user.
+
+## Important
+
+- NEVER modify migration files — they are immutable once created
+- NEVER skip migrations — they must be applied in sequential order
+- NEVER apply migrations without user confirmation
+- If a migration fails, report the error and suggest the user check the SQL manually
+- The `APPROVE DATABASE` CTO gate will trigger for each `supabase_push_migration` call

package/.claude/commands/push-secrets.md

@@ -0,0 +1,97 @@
+<!-- HOOK:GENTYR:push-secrets -->
+# /push-secrets - Push 1Password Secrets to Render & Vercel
+
+Sync secrets from 1Password to Render and Vercel environment variables using the `secret-sync` MCP server. Secret values never pass through the agent's context window.
+
+The prefetch hook has pre-gathered the current secret mappings from services.json and injected them as `[PREFETCH:push-secrets]` context above. Use that data for Step 0 instead of calling the MCP tool. If the prefetch data is missing, call `mcp__secret-sync__list_mappings` as usual.
+
+## Security Notes
+
+- The `secret-sync` MCP server handles all secret reading and pushing internally
+- Secret values are NEVER exposed to the agent — only key names and sync status are returned
+- Each sync operation is protected by GENTYR CTO gates
+- Requires `OP_SERVICE_ACCOUNT_TOKEN`, `RENDER_API_KEY`, and/or `VERCEL_TOKEN` configured via `/setup-gentyr`
+
+## Push Flow
+
+### Step 0: Check Configuration
+
+1. Call `mcp__secret-sync__list_mappings` to verify services.json exists and has mappings
+2. If no mappings are configured, inform the user:
+   - "No secret mappings found in `.claude/config/services.json`"
+   - "Configure mappings first, then run `/push-secrets` again"
+   - Show the expected services.json structure with op:// references
+3. If mappings exist, display the mapping table (key names and op:// references, no values)
+
+### Step 1: Choose Target
+
+Use `AskUserQuestion` to ask:
+
+**Question:** "Which services should receive secrets from 1Password?"
+
+**Header:** "Target"
+
+**Options (multiSelect: true):**
+- Option 1: "Render Production" — Push to production backend
+- Option 2: "Render Staging" — Push to staging backend
+- Option 3: "Vercel" — Push to frontend project
+- Option 4: "All services" — Push to everything
+
+### Step 2: Confirm
+
+Based on the selection, show the user how many secrets will be synced.
+
+Use `AskUserQuestion`:
+
+**Question:** "This will sync {N} secrets to {services}. Proceed?"
+
+**Header:** "Confirm"
+
+**Options:**
+- Option 1: "Yes, sync secrets" — Proceed
+- Option 2: "Show mapping first" — Call `mcp__secret-sync__list_mappings` and display
+- Option 3: "Cancel" — Abort
+
+### Step 3: Sync
+
+For each selected target, call `mcp__secret-sync__sync_secrets`:
+
+```
+mcp__secret-sync__sync_secrets({ target: "render-production" })
+mcp__secret-sync__sync_secrets({ target: "render-staging" })
+mcp__secret-sync__sync_secrets({ target: "vercel" })
+```
+
+Or for all at once:
+```
+mcp__secret-sync__sync_secrets({ target: "all" })
+```
+
+### Step 4: Report Results
+
+Display the results from `sync_secrets`:
+- List each key and whether it was created, updated, or errored
+- If there were errors, show which keys failed and the error messages
+- If there are manual entries in `services.json`, remind the user about them
+
+### Step 5: Verify (optional)
+
+Ask the user if they want to verify:
+
+Use `AskUserQuestion`:
+
+**Question:** "Verify that all secrets exist on target services?"
+
+**Header:** "Verify"
+
+**Options:**
+- Option 1: "Yes, verify" — Call `mcp__secret-sync__verify_secrets` and display results
+- Option 2: "No, done" — Skip verification
+
+## Important
+
+- NEVER attempt to read secrets directly via `mcp__onepassword__read_secret` — use `secret-sync` instead
+- NEVER log, echo, or display secret values — only show key names and sync status
+- If sync fails partway through, the `secret-sync` server reports which keys succeeded and which failed
+- To update existing secrets (rotation), run this command again — it will overwrite existing values
+- Run `/setup-gentyr` first to configure credentials if `secret-sync` server is not available

package/.claude/commands/services.json.example

@@ -0,0 +1,30 @@
+{
+  "_comment": "Project-specific service configuration for GENTYR slash commands (/push-secrets, /push-migrations). Copy to .claude/config/services.json and fill in your values.",
+  "render": {
+    "production": { "serviceId": "srv-YOUR_PROD_SERVICE_ID", "label": "Production" },
+    "staging": { "serviceId": "srv-YOUR_STAGING_SERVICE_ID", "label": "Staging" }
+  },
+  "vercel": {
+    "projectId": "prj_YOUR_PROJECT_ID"
+  },
+  "supabase": {
+    "migrationsDir": "supabase/migrations/"
+  },
+  "secrets": {
+    "renderProduction": {
+      "SUPABASE_URL": "op://Production/Supabase/url",
+      "SUPABASE_SERVICE_ROLE_KEY": "op://Production/Supabase/service-role-key",
+      "SUPABASE_ANON_KEY": "op://Production/Supabase/anon-key"
+    },
+    "renderStaging": {
+      "SUPABASE_URL": "op://Staging/Supabase/url",
+      "SUPABASE_SERVICE_ROLE_KEY": "op://Staging/Supabase/service-role-key",
+      "SUPABASE_ANON_KEY": "op://Staging/Supabase/anon-key"
+    },
+    "vercel": {
+      "NEXT_PUBLIC_SUPABASE_URL": { "ref": "op://Production/Supabase/url", "target": ["production", "preview", "development"], "type": "plain" },
+      "NEXT_PUBLIC_SUPABASE_ANON_KEY": { "ref": "op://Production/Supabase/anon-key", "target": ["production", "preview", "development"], "type": "plain" }
+    },
+    "manual": []
+  }
+}