orbital-express: Skill for Claude Code

Review against conventions (self-audit)

Run this against the files you created/changed BEFORE saying a task is done, or when reviewing a diff. Go through every applicable item; for each, point to the file:line and fix violations. The authoritative rules are docs/conventions.txt and the README — this is the fast checklist.

First run dependency-free yarn conventions:check. This self-audit remains mandatory even when the automated check passes.

Feature structure

• Plan/sign-off happened before scaffolding or edits.
• Every app/<Feature> has complete standard structure; no model-only/table-only exceptions. Extra domain files are allowed.
• yarn repair <Feature> --dry-run was reviewed before repair; repair did not overwrite existing files; reported wiring ambiguity was resolved manually.
• Root routes/models/workers/errors rely on auto-discovery; actions live in actions/.

Every JS file

• Header comment → 'use strict' → env → built-ins → third-party → services → helpers → models → queues (queue.get('XQueue') instances, right after models) → consts → module.exports (before methods) → methods.
• Imports ordered by increasing length; plain requires before destructured.
• Every named function closed with // END <name>.
• No require of a feature's own services/socket from an action it's called by (use the context object).

Actions / controllers / routes

• Action name V{version}{Action}[By{Role}][On{Device}]; file matches.
• JSDoc lists route, auth, Roles, req.args, Success, and every Error: code.
• Uses req.args (never req.body/req.query); POST/GET only; req.args = value after Joi (type coercion).
• Joi-validates args; HTTP action returns errorResponse(req, ...) (or errorResponseRollback(t, ...) inside a transaction); socket/task throws; catch re-throws (no manual 500).
• Returned records exclude sensitive fields (attributes: { exclude: models.x.getSensitiveData() }).
• Action AND controller have JSDoc headers (route, auth, Roles, args, Success, every Error).
• Flat success { status, success: true, ...payload }; status 200/201/202 correct; no data nesting.
• Controller is thin (role → action → res.status(result.status).json(result), next(error)); route is registered in the feature (root discovery is automatic).
• Role/device variants are separate methods (no role if/else in one); pure logic extracted to helper.js.
• Generated via yarn gen (not hand-created); existing source/test/mailer targets were not overwritten; action/task indexes are deduplicated and deterministic.