Use before running any build, test, lint, or format command to establish a working toolchain or runtime. Follows the user's declared environment presets, probes what is already available, provisions only in ways that do not modify the host machine (an ephemeral nix/guix shell or a throwaway container), and otherwise…
Use to review an existing Forseti deployment against best practice and surface what to harden. Runs the built-in config linter, then walks the operator-guide security checklist (2FA enforcement, rotated secrets, internal-listener exposure, forwarded-for trust, TLS headers, webhook key permissions, database choice, DCR…
Use to change an existing Forseti deployment toward a specific goal: add a social login provider (GitHub, Google, Microsoft, GitLab, Apple), enable Linux/POSIX login (PAM/NSS/sshd via the device grant), register a downstream OAuth client, enable or switch the email provider, turn on Enterprise SAML SSO, or adjust…
Use to set up a new Forseti deployment (the web UI and OIDC front-end for the Ory Kratos + Hydra stack), with or without Docker. Brings up the Ory stack and Postgres, generates secure Kratos/Hydra/Forseti config with fresh secrets, wires the mandatory keys (audit webhook token, cookie secret, admin allowlist, service…
Use when starting a new project or a substantial change that needs a written spec and plan before any code. Runs Q&A with the user, dispatches code-explorer and code-architect, writes spec and plan to the knowledge base, and gets an adversarial review before implementation. Not for small or mechanical changes - those…
Use when picking up a plan that was interrupted, in a fresh session. Finds the newest checkpoint for the project in the knowledge base, verifies its claims against the actual tree before trusting them, reports any drift, and continues execution from the stated next action.
Use when executing a written implementation plan from the knowledge base in a fresh session. Reads the spec and plan, works the tasks in order, checks them off in place, and keeps the expensive gates off the hot path. Pair with /plan:snapshot to stop cleanly and /plan:resume to pick up an interrupted run.
Use when interrupting a plan that is mid-execution - the user stops the run, context is getting long, the machine needs a reboot, or the session is ending unfinished. Writes a verified snapshot to the knowledge base so a fresh session can resume without rediscovery. Read by /plan:resume.