Every skill, filterable.

Scaffold Claude Agent SDK apps — subagent topology, tool budgets, harness loops, agent eval. Tri-agent.
Claude Agent SDK build harness with a Planner/Builder/Evaluator loop. Owns subagent topology, tool-budget design, harness loop shapes, and agent evaluation. Use for /oc-agent, "Claude Agent SDK", "build an agent", "subagent", "tool budget", "agent loop", "harness", "multi-agent", "agent eval", "orchestrator-worker". Model routing comes from oc-claude-api; agent-forge owns topology + harness shape.

First-party API design, OpenAPI, versioning, SDKs. v1.2 files breaking-change + deprecation tickets; drift on PR.
First-party API design and build harness with Designer/Builder/Conformance loop. Owns OpenAPI/GraphQL authoring, schema↔code parity, versioning + sunset strategy, pagination/error/idempotency conventions, typed handler scaffolding, and SDK generation for the API your own clients consume. Use for /oc-api, /oc-api design, /oc-api spec, /oc-api scaffold, /oc-api version, /oc-api lint, /oc-api sdk, "design our API", "OpenAPI", "GraphQL schema", "versioning strategy", "deprecate endpoint", "generate SDK", "API schema drift" (spec↔code; warehouse/data schema drift is oc-data-ops). For consuming someone else's API (Stripe, Slack, OAuth) use oc-integrations-engineer instead.

Idea → spec → design → build → launch in one skill. Reads PM tickets and writes sprints back via PM-MCP.
Unified app development: idea → spec → design → build with Generator/Evaluator QA loop → launch. Use for /oc-app, /oc-discover, /oc-spec, /oc-design, /oc-roadmap, /oc-scaffold, /oc-build, /oc-launch, "build me an app", "I have an app idea", or any software project. Chains to (when you invoke it): oc-stack-forge and oc-ux-engineer.

Pre-commit QA gate — fast checks on every commit. v1.2 attaches the failure report to the linked PM ticket on block.
Pre-commit QA gate that runs on every commit. Fast, opinionated checks: type safety, lint, tests, anti-pattern scan, secret detection, build verification, and dependency vulnerability scan. Blocks commits on failures, warns on cautions, passes silently on clean code. Invoked by oc-git-ops before every /oc-commit and /oc-git-sync. Use for /oc-bugcheck, "check this before I commit", "run the checks", "is this safe to commit", "pre-commit", "quick audit", "lint and test", "any bugs in this?", "sanity check".

Session persistence across skills — JSON checkpoint contract + status/next/doctor/validate tooling, catches drift.
Cross-skill protocol for session persistence. Not invoked directly — every other opchain skill implements this JSON checkpoint contract so state survives across conversations.

Build, debug, and migrate Claude API apps — model routing, prompt caching, tool use, version-migration playbooks.
Build, debug, and optimize Claude API / Anthropic SDK apps. Apps built with this skill include prompt caching by default. Also migrates existing Claude API code between model versions (4.6 → 4.7 → 4.8, Mythos Preview → Fable 5, retired-model replacements). Use for /oc-claude-api, "Anthropic SDK", "prompt caching", "cache hit rate", "tool use", "model migration", "extended thinking", "batch API", "files API", "memory", "citations".

Auditor → Fixer → Verifier quality loop. v1.2 posts findings to the linked PM ticket; HIGH+ filed as sub-tickets.
Code quality auditor with Auditor/Fixer/Verifier loop. Use for /oc-audit, "audit this", "find bugs", "code review", "pre-deploy check", "what's wrong with this code", or any code-level quality question. For fast pre-commit checks, escalate to oc-bug-check. For architecture- or infra-level security, escalate to oc-security-auditor.

Standing control register + audit-ready evidence bundles at deploy/release time. SOC 2 / HIPAA / GDPR.
Standing compliance operator: maps SOC 2 / HIPAA / GDPR controls to concrete repo and infra artifacts in a maintained control register, generates audit-ready evidence bundles at deploy and release time, and scaffolds the policy docs auditors ask for. Use for /oc-comply, /oc-compliance, "make us SOC 2 compliant", "get compliant", "SOC 2 evidence", "compliance checklist", "audit-ready", "control mapping", "GDPR", "HIPAA", "BAA", "data retention policy", "access review", "what would an auditor ask for", "compliance delta since last release". Consumes oc-security-auditor's readiness gaps (the point-in-time assessor); this skill is the standing register and evidence pipeline. Activated by `.opchain/compliance.yaml` (adds oc-deploy-ops' evidence gate row); absent profile, inert. Readiness and evidence, not certification and not legal advice. Technical control execution belongs to oc-security-hardening.

LLM cost attribution per skill phase, budget gates in checkpoints, and model-tier routing recommendations.
Cost operations harness — attribute LLM spend to the skill phase that incurred it, set per-phase and per-suite budgets that gate in the checkpoint, and recommend model-tier routing (Haiku for cheap repetitive phases, Opus for spec/audit/migration). Use for /oc-cost, "what did this cost", "cost attribution", "token cost", "budget gate", "model tier routing", "cost regression", "cheaper model", "spend per feature". Pairs with oc-prompt-ops (cost-regression gate alongside the score gate) and oc-telemetry-ops (feeds the public /dashboard cost stats).

Dashboards, BI, dense data — design spec + React prototype. v1.2 attaches the handoff bundle to the linked PM ticket.
Specialized dashboard and dense-information UI designer. Produces design specs AND working React prototypes with mock data for three archetypes: executive (KPI-driven, low density), operations (real-time, monitoring-dense), and analyst (exploratory, drill-heavy). ALWAYS trigger on /oc-data-forge, /oc-dash-forge, /dashboard, /dataviz-design. Also trigger on: "design a dashboard", "dashboard mockup", "BI design", "data visualization design", "KPI dashboard", "analytics UI", "monitoring dashboard", "dense information display", "what should the dashboard look like", "design a report view". Invoked by oc-ux-engineer when the UI is data-heavy and by oc-app-architect when the design phase encounters a dashboard surface.

Data-pipeline design + build: ingestion patterns, transformation layers, dbt, observable data contracts.
Data-pipeline harness with a Designer/Builder/Contract-Verifier loop. Owns the data estate: ingestion patterns (batch, stream, CDC), transformation layering (staging → intermediate → marts), dbt project design, and observable data contracts with freshness/volume/schema SLAs. Use for /oc-data-ops, "data pipeline", "ingestion", "ELT", "dbt", "data warehouse modeling", "data contract", "warehouse schema drift", "stale data", "data quality checks", "volume anomaly", "sync SaaS data into the warehouse", "medallion architecture", "backfill strategy". Invoked by oc-app-architect Phase 2 when discovery surfaces a data-heavy backend. Warehouse/queue choice comes from oc-stack-forge. NOT single-metric analytics (oc-signal-forge), NOT dashboards (oc-dash-forge), NOT live-pipeline engine swaps (oc-migration-ops), NOT API contract / schema-to-code drift (oc-api-dev), NOT the SaaS connector mechanics (OAuth/webhooks — oc-integrations-engineer builds the connector; this skill owns the pipeline + contract it feeds).

Audit gate → staging → production → monitor. Creates deploy tickets and updates linked PM tickets per env.
Deployment pipeline: audit gate → staging → production → monitoring. Use for /oc-deploy, "deploy this", "ship it", "push to production", "staging", "rollback", "health check", or any deployment task. Single-app managed deploys only: multi-container, self-managed or IaC deploys are oc-fleet-ops.

Documentation generator for every PR: PR body, PR comments, README/catalog docs, product docs, changelog and ADR upkeep.
Documentation creation, standardization, and upkeep for every PR. Invoked by oc-git-ops before PR creation and by release flows before release PRs. Use for /oc-docs, /oc-docs pr, "generate the PR docs", "update README", "standardize docs", "refresh product documentation", "write PR body docs", "post a PR docs comment", "docs upkeep", changelog/ADR/readme drift, or any request where implementation changes need reader-facing documentation. Catalog drift (generated catalogs out of sync with source) is oc-repo-ops.

Task-evaluated behavior changes with externally reviewed adoption.
Governed behavior improvement: reflect on recurring failures, propose rules, evaluate task outcomes and review adoption. Use for /oc-evolve, what keeps going wrong, propose a workflow improvement, or evaluate a learned rule.

Provision and operate containers across self-managed infra — k8s/Nomad/Compose/VMs. Terraform when it fits, not always.
Multi-container / orchestration deployment operator for self-managed infrastructure. Declares topology (containers/services × target environment), provisions infra with the right IaC tool (Terraform/OpenTofu when it fits, else Ansible/cloud-init/k8s-manifests/ Helm/Nomad/Compose), rolls the fleet with a rollout strategy, verifies fleet-wide health, and operates day-2 (scale/drain/replace/rollback). Specifically lands the modules oc-modularize-ops carves out of a monolith. Use for /oc-fleet, "deploy multiple containers", "kubernetes", "terraform", "orchestrate containers", "on-prem deployment", "deploy to VMs", "self-managed infra", "container fleet". Complements oc-deploy-ops (single-app managed PaaS): managed app → deploy-ops; multi-container/self-managed/IaC → fleet-ops. Trigger on multi-container / IaC / self-managed deployment.

Branch, commit, PR, sync, and release-tag workflows. `/oc-git-release` closes the release ledger; PM-aware (v1.3+).
Git workflow: branch, commit, PR, sync, release tag. Chains to (when you invoke it): oc-bug-check before every commit and the oc-docs-forge → oc-repo-ops pre-PR gate before every PR. Owns the release tag that oc-release-ops hands off. Use for /oc-git, /oc-commit, /oc-pr, /oc-push, /oc-git-sync, /oc-git-release, "commit this", "push to git", "create a PR", "tag the release", "sync to repo", or any git operation. "Commit and open a PR" is /oc-git-sync (branch → commit → push → PR); /oc-pr only drafts the PR description.

Source-grounded operational memory with signed promotion and read-time validation.
Governed operational memory: harvest outcomes, curate lessons, review provenance, and retrieve approved lessons. Use for /oc-hindsight, remember this failure, find a similar incident, or what did we learn.

Third-party APIs, OAuth, webhooks. v1.2 adds PM-tool MCP integration patterns (Linear / Jira / GitHub Issues).
Third-party API integrations with Planner/Builder/Tester loop. Use for /oc-integrate, "connect to Salesforce", "webhook", "OAuth", "API integration", "connect to Slack", or any external service connection. For designing or building your *own* first-party API (OpenAPI/GraphQL authoring, versioning, SDK generation), use oc-api-dev instead. When the destination is the data warehouse, this skill builds the connector; the warehouse-bound pipeline + data contract side is oc-data-ops.

Change the engine mid-flight — DB, framework, auth, platform. v1.2 mirrors the plan as parent + step children.
Migration and refactor operator for live systems: database migrations (D1 → Postgres, schema overhauls), framework upgrades (Hono v3→v4, React 18→19), auth provider swaps, monorepo restructures, and platform moves (Workers → Vercel). Produces incremental plans with rollback points at every step, executes with verification gates, and validates the end state matches the target spec. ALWAYS trigger on /oc-migrate, /oc-migration, /oc-upgrade, /oc-refactor, /oc-swap, /oc-move-to, /oc-platform-move. Also trigger on "migrate from X to Y", "upgrade to", "swap auth provider", "move database", "restructure the monorepo", "refactor to use", "breaking changes", "deprecation", "end of life". Also covers opchain ecosystem upgrades: "update all skills", "checkpoint protocol upgrade", "bulk update SKILL.md". Trigger when transforming an existing system from one state to another — not greenfield building (oc-app-architect) or documenting what exists (oc-reverse-spec).

Decompose a monolith with provably zero loss — golden fixtures from real data as the oracle. Willing to say don't.
Monolith decomposition operator. Decides whether modularization is even the right call (and is willing to say no), captures golden fixtures from REAL data for every boundary as an equivalence oracle, plans the seams + data ownership, and proves zero functionality/data loss by replaying the fixtures. Supports parallel-copy and strangler-fig strategies. Hands the bulk code-move + live cutover to oc-migration-ops (Structural type) and per-module deployment to oc-fleet-ops. Use for /oc-modularize, "break up the monolith", "extract a service from a live system", "split this codebase safely", "golden fixtures", "no functionality loss". For a behaviour-git-diffable repo/package reorg, use oc-migration-ops Structural instead. Trigger when decomposing a LIVE monolith carrying real traffic.

Post-deploy observability — uptime, errors, alerts, incidents. Opens PM incident tickets when alerts fire.
Post-deployment observability: uptime monitoring, error tracking, structured logging, alerting pipelines, and incident response runbooks. Sits after oc-deploy-ops in the pipeline — oc-deploy-ops ships it, oc-monitoring-ops watches it. Use for /oc-monitor, "set up monitoring", "error tracking", "uptime check", "alerting", "incident response", "observability", "what's happening in prod", "set up Sentry", "logging strategy", "on-call", "runbook", "SLO", "SLI", "is prod healthy", "why is it slow", "error rate", "status page". NOT opchain skill-usage metering (oc-telemetry-ops).

Pipeline coordinator — registry, status, routing. v1.2 reads `pm_refs` across skills; routes by ticket id.
Pipeline coordinator for the opchain dev ecosystem. Multi-project registry, cross-skill status, smart routing, and "what should I do next?" recommendations. Use for /oc-ops, "what's the status", "where did I leave off", "which project", "what should I work on", "show me everything", or any question about pipeline state across projects. Also trigger when the user seems lost, references multiple projects, or asks a vague dev question that needs routing.

Prompt-as-code — versioning, eval datasets, regression and drift detection for LLM prompts.
Prompt operations harness — treat prompts as versioned, diffable, source-controlled code. Owns prompt versioning, eval datasets, regression detection, and drift tracking. Use for /oc-prompt, "prompt versioning", "eval dataset", "prompt regression", "prompt drift", "golden set", "prompt diff", "LLM eval", "regression suite".

Test-pyramid design: coverage strategy, contract-test planning, load-test planning. Strategy, not execution.
Test-strategy designer: owns the test pyramid, coverage budgets, contract-test matrix, and load-test planning — the strategy layer split out of oc-bug-check. oc-bug-check runs the tests in under two minutes at the commit gate; oc-qa-ops decides which tests should exist and where. Writes `.opchain/qa.yaml`, which oc-bug-check's test check reads when present. Use for /oc-qa, /oc-qa pyramid, /oc-qa coverage, /oc-qa contracts, /oc-qa loadplan, /oc-qa audit, "test strategy", "test pyramid", "coverage budget", "what should we test", "contract testing", "plan a load test", "too many e2e tests", "our tests are slow", "test debt", "flaky tests", "unit vs integration". Invoked by oc-app-architect Phase 2 to author 06-testing.md. NOT test execution (oc-bug-check), NOT load-test execution or perf budgets (oc-scale-ops), NOT first-party API conformance authoring (oc-api-dev), NOT writing the tests themselves (the build loop's Generator, or /oc-audit test-bootstrap for untested codebases).

Design and build RAG systems — vector DB choice, embeddings, chunking, hybrid search, retrieval eval. Tri-agent.
Retrieval-augmented generation harness with a Designer/Builder/Evaluator loop. Owns vector DB selection (pgvector, Turbopuffer, Pinecone, Supabase Vectors), embedding-model choice, chunking strategy, hybrid search, and retrieval evaluation. Use for /oc-rag, "RAG", "vector database", "embeddings", "chunking", "semantic search", "hybrid search", "retrieval eval", "reranking", "knowledge base".

Plan, draft, bump, announce, ship a release. Closes the loop from sprints to /changelog to oc-git-ops to oc-deploy-ops.
Release-cadence operator. Plan, draft, bump, announce, and ship versioned releases of opchain (or any opchain-managed project). Reads sprint checkpoints, proposes the next semver, drafts the /changelog entry from what actually shipped, bumps every skill version atomically, and hands off to oc-git-ops + oc-deploy-ops. Use for /oc-release, /oc-release plan, /oc-release draft, /oc-release bump, /oc-release announce, /oc-release ship, "cut a release", "ship v1.3", "draft the changelog", "what's in this release", "version bump". The release tag itself is oc-git-ops (/oc-git-release).

Repository hygiene and PR readiness gate. Ensures docs, generated files, git state, catalogs, and cleanup are PR-ready.
Repository hygiene and PR readiness gate. Invoked by oc-git-ops before every PR and after oc-docs-forge generates the PR documentation packet. Use for /oc-repo, /oc-repo audit, /oc-repo verify, "repo hygiene", "clean this repo", "is this PR ready", "check generated files", "catalog drift", "plugin/cache drift", ".gitignore policy", orphaned docs/files, stale generated artifacts, source-vs-doc mismatch, or any repository cleanliness question.

Turn existing code into pipeline-ready specs. v1.2 mirrors discovered scope to the PM tool as parent + children.
Reverse-engineer existing code into spec docs. Use for /oc-rev-spec, /oc-reverse-spec, /oc-rev-full, /oc-rev-scan, /oc-rev-design, /oc-rev-stack, /oc-rev-sprint, "document this codebase", "generate specs from code", "backfill specs", or when pointing at existing code that needs documentation.

Load, caching, capacity planning. v1.2 posts load-test reports to the PM ticket; HIGH risks as sub-tickets.
Scaling readiness: load test, perf budgets, caching, capacity planning. Use for /oc-scale, "load test", "can this handle more users", "performance", "caching strategy", or any scaling question.

Threat modeling, OWASP hardening, attack-surface review. v1.2 files CRITICAL findings as PM incident tickets.
Practice-level security posture assessment: threat modeling (STRIDE), OWASP Top 10 compliance mapping, runtime/infra hardening (CSP, TLS, DNS, WAF, Cloudflare config), and attack surface mapping. Operates ABOVE oc-code-auditor — oc-code-auditor finds SQLi and hardcoded secrets; oc-security-auditor asks "what's the threat model?" and "is the infra hardened?" ALWAYS trigger on /oc-security, /oc-secaudit, /oc-sec, /oc-threat-model, /oc-owasp, /oc-hardening, /oc-attack-surface, /oc-posture. Also trigger on: "threat model this app", "is this secure enough", "OWASP compliance", "security review", "attack surface", "is it hardened", "what are the security risks", "SOC2 readiness", "pen test prep", "security architecture review", "audit the CSP policy", "review WAF rules", "check TLS config". Trigger on architecture-, infrastructure-, or compliance-level security questions — not just code bugs. Assessment only: oc-security-hardening (/oc-harden) executes the fixes; oc-compliance-ops keeps the register.

Remediation operator: execute hardening fixes and stand the per-deploy hardening gate. Auditor finds; this fixes.
Security remediation and enforcement operator — the execution half of the security pair. oc-security-auditor assesses (/oc-hardening audits the posture); oc-security-hardening executes (/oc-harden writes the fixes): security headers, staged CSP rollout, TLS/WAF/rate-limit config as code, secrets hygiene, dependency-pinning policy. Maintains `.opchain/hardening.yaml` — the declared-controls manifest — and stands the per-deploy gate that verifies it, the "before every deploy" step auditor findings never had. Use for /oc-harden, /oc-harden baseline, /oc-harden fix, /oc-harden csp, /oc-harden gate, "harden this", "fix the security findings", "the pen test found", "add security headers", "roll out CSP", "rate limit this endpoint", "rotate secrets", "block deploys on security regressions", "security baseline". NOT assessment (oc-security-auditor), NOT code-bug fixing (oc-code-auditor's Fixer), NOT dependency vuln scanning (oc-bug-check — this skill owns pinning policy, not the scan).

Question → trustworthy metric: instrument, harvest, prove it answers the question, then wire it. Backend only.
Analytics & signals backend harness with a Designer/Builder/Evaluator loop. Derives new metrics from the question they answer, builds the instrumentation + harvester + transform, and adversarially verifies the signal is correct AND answers the question before wiring it to a consumer. Use for /oc-signal, "new metric", "instrument this", "analytics backend", "data harvesting", "is this metric right", "wire up a signal", "derive a KPI". Hands the validated signal (stable read contract) to oc-dash-forge for rendering. NOT pipeline telemetry (oc-telemetry-ops), NOT dashboards (oc-dash-forge), NOT prod uptime (oc-monitoring-ops), NOT estate-level data pipelines — ingestion/dbt/warehouse layering is oc-data-ops; when a metric needs a pipeline that doesn't exist, chain to /oc-data-ops design and build the signal on the contracted mart.

Stack decisions, Cloudflare patterns, typed pipeline. v1.2 records the chosen stack on the linked PM ticket as an ADR.
Stack advisor for any platform: Cloudflare, Vercel, AWS, Supabase, Rails, Django. Use for /oc-stack, /oc-stack-decide, /oc-feature, "what stack", "tech stack", "what should I build with", or framework comparisons. Invoked by oc-app-architect.

Opt-in, local-first usage metering to .checkpoints/usage.sqlite; anonymized local aggregate export.
Telemetry operations harness — opt-in, local-first usage metering that records which skills and phases actually run, to a local .checkpoints/usage.sqlite store, then produces anonymized local aggregate exports. Use for /oc-telemetry, "usage metering", "opchain usage telemetry", "opt-in analytics", "which skills do people use", "usage stats", "dashboard data", "anonymized usage". Default stance is OFF — nothing is recorded until you explicitly enable it, and no prompt content or PII ever leaves the machine. Pairs with oc-cost-ops (cost per run) for the cost-per-feature dashboard stats. NOT application or production observability (oc-monitoring-ops).

Update repo-local Opchain skills and helpers in one command, preserving telemetry and checkpoints.
Check and update Opchain skills installed in the current repository. Use for /oc-update, "update Opchain", "refresh my Opchain skills", or "check for Opchain updates". Preserves telemetry consent, usage history, checkpoints, and unrelated skills. Does not upgrade application dependencies or globally installed plugins.

Design Planner → Generator → Evaluator. Posts eval scores to the PM ticket; a11y as sub-tickets.
UI/UX design harness with Design Planner/Generator/Evaluator loop. Use for /oc-uxe, "review the UX", "design iteration", "component library", "accessibility audit", "is the UI consistent", or any design quality question. Routes data-heavy screens (dashboards, BI, analytics) to oc-dash-forge via /oc-uxe dash.