Catalogue complet des skillsComplete skill catalogue

Scaffold (or retire) the core-lookups BRIDGE of a generated client app — the read-only /api/core/{users,roles,departments,job-titles,offices,languages,groups}/lookup endpoints the generated use{E}Lookup hooks call, until the socle serves them natively.

Audits the actors of a `.smartstack/ba/` project — existence, duplicate names (case-insensitive), missing type (ACT-001, ACT-002, ACT-006 — ACT-003..005 retired). Actors are PROJECT-scoped, so it reads every `<APP>/acteur.md` plus the menu tree, applies the rules, and writes a verdict to `_audit/actors.md` at the project root. Run after `/ba-create-actors` or as part of pre-dev readiness.

Cross-dimension coherence audit of one `.smartstack/ba/` module — verifies that data-model fields with state semantics have matching business rules, use cases and screens, that use-case actors exist in RBAC, that screen entity refs resolve, and that a kanban is a view of its list and not its own section (XD-001..006). Reads the module's `entité.md`, `règles-métier.md`, `use-case.md`, `rbac.md` and its section `screen.md` files together, writes a verdict to `_audit/cross-dimension.md`. Run after the per-dimension audits or as part of pre-dev readiness.

Cross-references the BA data model of a module against the EXISTING project code — detects entities that extend an existing class, reference a Core/existing entity as FK, duplicate one, collide with the SmartStack Core catalogue, re-implement a platform capability (file storage, search, …), or model a PERSON without the auth_Users extension link (CODE-007, err — fail-closed mirror of C-4/DM-018c) (CODE-001..007). Reads the module's `entité.md`, scans `src/*.Domain/**/*.cs`, checks the static Core + capability catalogues (no scan needed), writes a verdict to `_audit/cross-ref-code.md`. Run after `/ba-create-data-model` or as part of pre-dev readiness.

Audits the conceptual data model (MCD) of a `.smartstack/ba/` module — attributes, FK integrity, cycles, naming, orphans, traceability, indexes, implicit FKs, unreferenced lookups, classification conventions, code-pattern numbering, Core-entity duplication, platform-capability steering, no file content in the MCD, derived declarations, and code-like classification — near-miss Code-pattern declarations + unclassified synonym attributes (Référence/Numéro/Matricule…) — plus, moved LEFT of the readiness GO: index integrity (every **Index** column exists, never TenantId in a unique — the scaffolder's own error, six phases earlier), complete attribute types (string maxLength, decimal precision/scale, enum values), no framework field listed, tenancy declared (**Portée** → tenantMode), and the model retaining what the BA no longer uses — dead columns (attribute grain) and leftover state values (value grain), and the business TEST DATASET `jeu-de-test.md` — present where the module carries business entities, coherent with the MCD, the rules, the actors and the cited modules' datasets, never on a reference table, every Flow status represented (DM-001..032). Reads the module's `entité.md` + `use-case.md` + `règles-métier.md` (+ `jeu-de-test.md`), writes a verdict to `<MODULE>/_audit/entité.md`. Run after `/ba-create-data-model` or as part of pre-dev readiness.

Audits the menu (Application / Module) of a `.smartstack/ba/` project — module semantics, cross-app duplicates, SmartStack Core collisions, orphans/empty, out-of-scope coherence, hierarchy code distinctness (MENU-001..008). Reads the tree, writes a verdict to `_audit/menu.md`. Run after `/ba-create-menu` or as part of pre-dev readiness.

Audits the on-disk PRD of ONE module in a `.smartstack/ba/` project — checks across 7 dimensions: structure, completeness, clarity, consistency, traceability, feasibility, slices + per-page contract + custom-action contract + related-tabs contract (PRD-103..105 + PRD-108 route families, the 360 view) + the file-upload guard (PRD-107 — no `type:file` custom action; attachments pattern instead) + list elegance (PRD-109 column visibility budget, PRD-110 filter tiers) + form/detail sections (PRD-111 well-formed `sections[]`, PRD-112 grouping authored where warranted) + view-set completeness (PRD-114 a mutable list declares its form/detail siblings) + cards representation folding (PRD-117 viewModes on the list pagespec, never a standalone SmartCard pagespec) + quick segments (PRD-116 cohort tabs: labelled, defaulted, wirable) + sort/density/empty-state coherence (PRD-118) + detail summary integrity (PRD-119) + form lifecycle (PRD-120 well-formed status-anchored `lifecycle` block — CLI `create-prd/cli/derive-lifecycle --mode check`; PRD-121 lifecycle authored where the entity lives one) + action-permission binding (PRD-128 — a kind:api action's permission roots at its OWN module.section, section grain; engine = derive-action-specs' blocking rejected[]) + business-rule links (PRD-129 every enforceable rule linked / PRD-130 cited codes resolve — CLI `create-prd/cli/derive-rule-links --mode check`) + use-case coverage (PRD-131 every user-goal UC reaches the pagespecs — CLI `create-screen/cli/derive-uc-coverage`) + coded-entity parity (PRD-132 entité.md `**Code pattern**` ⇔ pagespec `codedEntity` flag both ways — facets `label`/`supplied` included, unusable line = err, unparsable near-miss declaration (table cell / wrong casing) = err, supplied+{SEQ} = warn — CLI `ba-develop/cli/derive-code-specs --mode check`) + tab budget (PRD-133 — rendered strip ≤ 7 warn / ≤ 9 err, band cartouches excluded, unified fiche honoured; same derive-related-tabs run, RTV-108) + summary demanded (PRD-134 — ≥ 4 rendered strip triggers and no `summary` = warn, CLI `create-prd/cli/derive-detail-summary --mode check`) + kanban representation (PRD-135 — the `kanban` block folded on the LIST pagespec: columns ⊆ status enum verbatim, BR Flow ⇄ transitions parity both ways, viewModes coherence, no standalone kanban pagespec, labels seeded — CLI `create-prd/cli/derive-kanban-spec --mode check`). Reads `prd.md`, the three `prd.*.md` slices and the `pagespecs/*.md` blocks against the upstream BA docs, then writes a verdict to `_audit/prd.md` carrying the dev-readiness gate (`GO|NO-GO`). GO is the gate `/ba-develop` reads. User Story / Acceptance Criteria checks live in `/ba-audit-use-cases` (UC-012..018) — the PRD no longer carries US/AC sections; AC live under each UC in `use-case.md`. Run after `/ba-create-prd`.

Pre-development readiness orchestrator for a `.smartstack/ba/` project. Does NOT re-run any dimension's rules — it reads the per-dimension verdicts already written under `_audit/*.md`, aggregates them across every module and the 9 dimensions, and writes a project-readiness summary with an overall GO / NO-GO. Run after the `/ba-audit-*` dimension audits, before `/ba-create-prd` + development.

Audits the RBAC permission matrix of a `.smartstack/ba/` module — minimum permissions, segregation of duties, actor coverage, reference integrity, data-scope coherence, derived-lookup freshness, permission-floor mirror freshness, and unmaterialized `team`/`custom` Portées said out loud (RBAC-001..010). Reads the module `rbac.md`, the app `acteur.md` and the section `use-case.md`; RBAC-008/009 reuse the `derive-lookup-grants` and `derive-permission-floor` engines by direct import (their shared source factories + drift layer, never a spawn), writes a verdict to `_audit/rbac.md`. Run after `/ba-create-rbac` or as part of pre-dev readiness.

Audits the business rules of a `.smartstack/ba/` module — completeness, conflicts, redundancy, example quality, entity/UC references, per-ruleType edge-case coverage, and — at app/project scope only — cross-application similarity (warn) (BR-001..012). Reads `règles-métier.md` plus the module's `use-case.md` and `entité.md`, writes a verdict to `_audit/règles-métier.md`. Run after `/ba-create-business-rules` or as part of pre-dev readiness.

ONE deterministic pass over the whole `.smartstack/ba/` corpus — the audit-ba CLI loads every doc once, runs the ~115 MECHANICAL audit rules of all 11 dimensions (menu, sections, actors, use-cases, rules, rbac, data-model, screens, cross-dimension, cross-ref-code, sources), publishes the parse totals, writes every `_audit/<dim>.md` verdict and `_audit/audit-ba.json`, and FAILS CLOSED on parser/control divergence (exit 3 « parsing suspect »). The LLM's only job here is arbitrating the compact `judgmentNeeded[]` excerpts (~9 judgment rules + hybrid arbitrations) — NEVER re-reading the corpus. Use for « audite le BA », « audit complet », « relance l'audit après mise à jour des skills ». Replaces the per-module LLM audit campaign (394M tokens on ImmoHub) for every mechanical rule.

Audits the screen specs of a `.smartstack/ba/` section — coverage, entity refs, SmartComponent coherence, navigation integrity, related-tabs (360 view), home-page hierarchy, UC traceability, custom-actions structure, coded-entity code fields, attachment screens bound to a metadata entity, list column/filter inflation, form field grouping (Section/Onglet), create-form phase discipline, mandatory SmartSectionHome on multi-resource sections, observable action results, dashboard/entity binding, instance-verb confirmation, use-case coverage — every user-goal UC served by a surface, and the shared tab-bar budget — inner + related tabs ≤ 7/9, band cartouches excluded (SCR-001..025). Reads the section `screen.md` plus the module `entité.md`/`rbac.md` and the section `use-case.md`; the related-tab rules (SCR-009/014) and the tab-bar budget (SCR-025 ← RTV-009) run DETERMINISTICALLY through the derive-related-tabs CLI, the UC-coverage rule (SCR-024) through the derive-uc-coverage CLI. Writes a verdict to `_audit/screen.md`. Run after `/ba-create-screen` or as part of pre-dev readiness.

Audits the menu sections of a `.smartstack/ba/` project — module-section coverage, duplicate/ambiguous sections, sibling state-variant sections (same primary subject), cross-module and cross-app duplication (SEC-001..008 — SEC-006 retired, XAPP-001..003). Reads the section nodes under a module, writes a verdict to `_audit/sections.md`. Run after `/ba-create-menu` or as part of pre-dev readiness.

Audits the client-sources registry (`.smartstack/sources/`, SIBLING root of the BA tree) and the `SRC-NNN §n` citations the BA specs carry — registry coherence, source completeness, web-extract contract, citation resolution, scope coverage, dead and superseded sources (SRC-001..007, all mechanical, fail-closed: « no citation » is only acceptable when no in-scope source exists). Reads the registry through the shared engine, writes verdicts to `_audit/sources.md` (project root) and `<APP>/<MODULE>/_audit/sources.md`. Run after `/ba-create-sources` or as part of pre-dev readiness.

Audits the use cases of a `.smartstack/ba/` module — completeness, step quality, vague language, scope respect, actor references, redundancy, acceptance-criteria contract, exception ↔ AC parity, and — at app/project scope only — cross-application similarity (warn) (UC-001..023). Reads the section `use-case.md` files + the app `acteur.md` + the module `entité.md` (for AC entity refs); the exception-parity rule (UC-022) runs DETERMINISTICALLY through the derive-uc-coverage CLI. Writes a verdict to `<MODULE>/_audit/use-case.md`. Run after `/ba-create-use-case` or as part of pre-dev readiness.

Change request on a FINISHED business-analysis scope — add or modify ONE element after the fact (a use case, a business rule, an actor, a permission row, an entity attribute, an entity, a screen) without re-running a whole phase. Router + one playbook per artefact (kinds/<kind>.md — analyse the request, challenge it, author, verify, propagate, audit). Runs the read-only derive-change-impact CLI, which allocates the next free code, detects near-duplicates, fails closed on missing prerequisites and returns the ORDERED downstream checklist (rules, RBAC, screens, pagespec deltas, derive CLIs, audits, /ba-develop re-entries), then re-parses the owner document after the Write. Never deletes (that is /ba-reconcile-menu), never re-runs /ba-create-prd on a module that already has a PRD, never invents a code.

Phase 2 of business analysis. Defines the project's actors (roles) that interact with the applications, and writes them to `acteur.md` at the Application level under `.smartstack/ba/`. Conversational: reads the menu tree and existing actors, proposes coverage per app, asks the user to validate, then writes the file. Run after the menu (`/ba-create-menu`), before use cases.

After Phase 1 (menu), produces a BA creation order plan — a topologically-sorted ordering of modules showing which modules to work on first across all BA phases (actors → use cases → rules → RBAC → data model → screens). Conversational: reads module contexts, infers inter-module dependencies, asks the user to validate, then writes the plan. Run after /ba-create-menu, before /ba-create-actors.

Phase 4 of business analysis. Captures, classifies and elaborates structured business rules (with concrete valid + invalid examples) and writes them to `règles-métier.md` under `.smartstack/ba/`. Conversational: first has the user choose the application → module to work on, then reads that scope's menu context, actors and use cases, proposes rules, asks the user to validate, then writes the file. Writes stay inside the selected application; similar rules found in other applications are reported, never modified. Run after use cases (`/ba-create-use-case`), before RBAC.

Phase 6 of business analysis. Builds the conceptual data model (MCD) of each business module — entities, attributes, computed formulas, relationships and indexes — and writes it to `entité.md` at the Module level under `.smartstack/ba/`. Conversational: reads the menu tree plus the module's use cases and business rules, deduces the entities, asks the user to validate, then writes the file. Run after RBAC (`/ba-create-rbac`), before screens (`/ba-create-screen`).

Phase 1 of business analysis. Builds the Application → Module → Section → Resource menu hierarchy for a project as a folder tree of `index.md` files under `.smartstack/ba/`. Conversational: reads the current tree, researches the domain, drafts the next level, self-audits the draft, then proposes it in 3 tiers (Obligatoire / Suggestion / Élargissement), asks the user to validate, and persists every node through the colocated `menu-node` CLI (add / rename / delete — deterministic: folder + `index.md` + six placeholders, the parent `## Enfants` spliced with its anchor intact, the downstream codes, permission paths and pagespec references rewritten on a rename, `previousCodes=` recorded). Also the ENRICH entry point for one node added to a finished menu. Run this first, before defining actors, use cases, rules, RBAC, data model, or screens.

Generates a phased development plan ordering modules by their cross-module data-model dependencies. Reads entité.md across selected applications, builds a dependency graph, topological-sorts into parallel development waves, and writes dev-plan.md. Invoke between the BA audit phase and /ba-develop.

Synthesises the upstream BA `.md` tree of ONE module (menu, actors, use cases, business rules, RBAC, data model, screens) into a Product Requirements Document on disk: `prd.md` (product framing: context, goals, non-goals, MoSCoW, technical constraints), three phase slices, per-screen `pagespecs/*.md` (each carrying a machine spec block), and `claude.md`. User stories and acceptance criteria are NOT in the PRD — they live under each UC in `<section>/use-case.md` as the test-scaffolder's input. The output drives development through `/ba-develop`. Run after the BA phases (and `/ba-audit-pre-dev` GO), before development.

Phase 5 of business analysis. Defines the RBAC permission matrix (who can do what) for each module and writes it to `rbac.md` at the Module level under `.smartstack/ba/`. Conversational: first has the user choose the application → module to work on, then reads that scope's menu context, actors, use cases and rules, proposes coverage per actor × action, asks the user to validate, then writes the file. Writes stay inside the selected scope. Run after business rules (`/ba-create-business-rules`), before the data model (`/ba-create-data-model`).

Phase 7 of business analysis (the LAST BA phase). Designs the UI screens of each section as SmartComponents (SmartListView, SmartForm, SmartDashboard, SmartKanban, SmartSectionHome, …) and writes them to `screen.md`, authoritative at the Section (and Resource) level under `.smartstack/ba/`. Each screen binds one entity, a permission and the use cases it serves. Conversational: first has the user choose the application → module (→ section) to work on, then reads the section's data model / RBAC / use cases, proposes screens, asks the user to validate, then writes the file. Writes stay inside the selected scope. Run after the data model (`/ba-create-data-model`); hands off to PRD generation (`/ba-create-prd`).

Ingests the CLIENT-PROVIDED source material of a project (cahiers des charges, PDF, Word/Excel, notes, emails, screenshots — and RETAINED web findings) into the committed registry `.smartstack/sources/`: each source gets a stable greppable code `SRC-NNN`, judgment tags, a precise summary and §-anchored extracts, so every BA phase can pull exactly what it needs and CITE it (`- **Sources** : SRC-001 §2`) in the written spec. Conversational: the CLI fingerprints/dedups/extracts deterministically, the model reads and judges, the user validates tags and scope. Run any time — before or during the BA phases; the audit dimension `sources` (SRC-001..007) keeps the registry and the citations honest.

Phase 6.5 of business analysis (OPTIONAL, after the data model). Authors the module's business TEST DATASET — `jeu-de-test.md` — 5 to 8 realistic, FICTITIOUS rows per business entity, validated by the client with THEIR vocabulary (their vehicles, sites, statuses). One dataset, every consumer — the seed of dev/test/qual (the second seed tier, next to the setup rows of `**Valeurs initiales**`), the fixtures of the acceptance tests, the UAT, and a BA simulator that shows the client's own rows instead of hash noise. Conversational — reads entité.md, use-case.md, règles-métier.md and the client sources, proposes rows in 3 tiers, the client corrects, the skill writes the file and runs the deterministic checker. Rows are cited across modules by KEY, never copied. Run after `/ba-create-data-model`, before or after `/ba-create-screen`; audited by `/ba-audit-data-model` (DM-029..032).

Phase 3 of business analysis. Turns each section's scope into Cockburn-style business use cases (primary actor, preconditions, main / alternative / exception flows, postconditions), written to `use-case.md` at the Section level under `.smartstack/ba/`. Conversational: first has the user choose the application → module → section to work on, then reads that section's actors and existing use cases, proposes use cases, asks the user to validate, then writes the file. Writes stay inside the pinned scope; similar UCs found in other applications are reported, never modified. Run after actors (`/ba-create-actors`), before business rules (`/ba-create-business-rules`).

Autonomous BA pipeline orchestrator. Chains phases 2-7 (actors → use cases → rules → RBAC → data model → screens) module by module in wave order, each phase running as a subagent with the create → audit → fix cycle. Reads ba-order.json for wave ordering. Run after /ba-create-ba-order (Phase 1.5).

Pass 2 of the optional Two-Pass fast-modeling path. Take a SINGLE inventory item flagged `moderate` or `complex` (from a scope's `_inventory.md`) and expand it into a fully-detailed use case (Cockburn flows, pre/postconditions) or business rule (expression + concrete valid/invalid examples), then write it into the authoritative doc (`use-case.md` for a UC at its section, `règles-métier.md` for a rule at its scope) under `.smartstack/ba/`. Reads the inventory + the authoritative doc + `acteur.md`; writes by appending/Editing the doc while preserving every existing item.

Pass 1 of the optional Two-Pass fast-modeling path. In ONE fast pass, emit a lightweight inventory of ALL candidate use cases + business rules for a scope (application / module / section), each flagged `simple | moderate | complex` so a detail pass can route effort. Reads the `.smartstack/ba/` menu tree + actors for context and writes a planning checklist to `.smartstack/ba/<scope>/_inventory.md`. Hands off to `/ba-modeling-detail`.

Reconciles the `.smartstack/ba/` menu tree (sections/modules currently in `index.md`) against the codes embedded in downstream documents (`use-case.md`, `screen.md`, `règles-métier.md`, `rbac.md`). Detects RENAMES (heuristic) and DELETIONS, asks the user to validate the diff, then rewrites the downstream docs (drops stranded UC/SCR/BR/RBAC blocks, scrubs body references, renames codes in place). Idempotent. Run AUTOMATICALLY as Phase 0.5 of `/ba-loop` whenever the menu was modified after content was created — never skip a modified menu, always audit and correct.

Backfills the i18n translations of an already-written PRD. Scans a module's `pagespecs/*.md` for untranslated `i18nKeys` placeholders of the form `"[en] <fr>"` / `"[it] <fr>"` / `"[de] <fr>"` (the abandoned "author FR, defer the rest" convention), translates each from its authoritative FR sibling into idiomatic en/it/de, and rewrites the JSON blocks in place — preserving every other value. Also fills FR-only `form.section.*` labels (the derive-form-sections backfill seeds fr and leaves en/it/de absent — PRD-111). Conversational: reports what it found, asks the user to validate the translations (Swiss house terms), then writes. Run when `/ba-audit-prd` PRD-089/PRD-111 or `DEV-UI-029` flags placeholders in an existing PRD; re-scaffold the Frontend afterwards to regenerate the shipped bundle.

Audit code generated by the API phase against the PRD slice — controllers, routes, HTTP actions, RBAC attributes, DTOs, integration tests

Audit the PUBLIC (third-party, machine-to-machine) API surface of a generated client extension — whitelisted route prefix, seeded catalogue row, catalogue-permission ↔ compiled-constant parity, mandatory tenantId binding, server paging caps, the platform export envelope, business-layer reuse, BA declaration parity, published-contract freshness, seed-provider DI registration, grant grain and the class-level guard block (DEV-XAPI-001..014)

Static parity gate between the generated frontend service URLs and the generated backend controller routes. Catches the "frontend calls a URL the backend never serves" class of bugs (the 404 the user sees in the browser) BEFORE runtime. Phase 3e gate of `/ba-develop`.

Audit code generated by Phase 0 (Core Foundation Seed) — every PRD module must have nav + roles + permissions in the 6 Core providers, DI registration must be in place, the providers must be deterministic (no hand-edits), and the seeded role→permission grants must match the BA rbac.md matrices in BOTH directions (DEV-CORE-011 via derive-rbac-grants --mode check).

Audit the generated persistence layer against the BA data model — deterministic CLI (DEV-DAT-001/002/003/007/008/009/010 — every entity has its migration, table naming, no duplicate CreateTable, migration filenames, every declared relationship a REAL FK constraint in the Configuration AND the migration with the declared cascade, every declared **Index** — non-unique included — present in a migration, the business test dataset `jeu-de-test.md` reached its guarded `{Module}TestDataSeedDataProvider`). After-Phase-1 (Entities) gate of /ba-develop. DEV-DAT-004/005/006 stay conversational (twins: DEV-CORE-011, DEV-UI-046)

Audit code generated by the Domain phase against the PRD slice — entity files, FK pairing, naming, traceability, drift detection

Generates real test suites per architectural layer with business rule coverage, consuming NuGet (xUnit, FluentAssertions, Moq, FluentValidation.TestHelper) and npm (Vitest, Testing Library, React Query) packages.

Development workflow index — drives module development from PRD to production-ready SmartStack extension (NuGet + npm) with mandatory tests at every layer.

Audit of generated code against SmartStack conventions (i18n, React, structure, dynamic routing, RBAC, security)

Detects @customised page drift from the regenerated service/hook contract (DRIFT-001/002). A page marked `@customised` is preserved across regeneration, so it can silently drift when the generated contract changes. Runs in /ba-develop Phase 3e (especially after a `--force` regeneration).

READ-ONLY audit of the SmartStack development skills to verify their conformance to the DB-driven dynamic routing architecture (PageRegistry + componentRegistry + DynamicRouter). Produces a textual report without modifying any skill.

Generates full CQRS stack — Commands, Queries, Handlers, DTOs, Validators, Service interface + implementation — on SmartStack NuGet abstractions (ICoreDbContext, MediatR, FluentValidation).

Generates the **integration-strata** API controller (generic CRUD served at /api/{module}/{section} from its [NavRoute], Swagger group "integration") with RequirePermission, auto-mapped DTO → Command conversions, and module-scoped permission classes. Consumes NuGet packages (SmartStack.Core, SmartStack.Api, MediatR). The companion **screen-driven strata** lives in /api/screens/... and is generated by `scaffold-screen-controller`.

Phase 0 of /ba-develop — generates one Core Foundation Seed bundle per declared application (6 IClientSeedDataProvider classes per app covering navigation + tenant↔app links + roles + permissions + role-permission mappings + dev test users) by invoking the deterministic `scaffold-core-seed` CLI. Zero creative work for the agent: the spec is built by the Studio backend (`prepareCoreSeedContext`) from the BA menu / actors / permissions and dropped to a temp file before this skill runs.

Generates Domain entities on the project-local ExtensionBaseEntity shim (soft-delete + domain events over SmartStack.Domain.Common.BaseEntity), domain events, EF Core configurations with schema targeting, and migrations.

Generates the **screen-driven** API stratum: one controller per section exposing one endpoint per screen, payload shaped from the pagespec. Routes under /api/screens/{plural}/{action} with Swagger group "screens". Companion of `scaffold-controller` (integration stratum). Both call the SAME Business layer — rules never duplicate.

Generates module-scoped IClientSeedDataProvider implementations for reference data (lookup tables, enum codes — the SETUP tier, every environment), the guarded business TEST DATASET provider (jeu-de-test.md → testData[] — dev, test and qual on demand, never prod) and per-module overrides. Cross-app navigation, roles, permissions, and role-permission mappings are NOT this skill's job — they live in scaffold-core-seed (Phase 0). Output goes under Persistence/Seeding/Applications/{AppPascal}/Modules/{ModuleCode}/ to mirror the per-application module layout.

.NET Clean Architecture 4-layer SmartStack

Refine a user-reported bug — rephrase, classify, and cross-reference the code in the current worktree.

Diagnose and auto-fix SmartStack dev-runner issues (backend + frontend)

Diagnose and auto-fix SmartStack .NET backend failures

Diagnose and auto-fix SmartStack React+Vite frontend failures

Conversational triage on a tracked bug — answer the user, decide whether to reopen the fix or re-audit, never modify code directly.

Implement a fix for a user-reported bug — edit code, verify, commit atomically with a traceable message.

Transverse dashboard reference + scaffolder, consumed DURING development so every dashboard uses the right components, the right UI, and correct theming. It scaffolds editable, theme-compliant dashboard primitives (KpiCard, ChartCard, ListWidget, DashboardGrid, WidgetRenderer) into src/components/dashboard/ — because the package's own dashboard components are internal/not exported — and it defines the typed-widget config + the per-dashboard data contract that scaffold-component renders. Theme tokens come from scaffold-theme (--dataviz-*, --chart-*, --kpi-*).

Generates TypeScript service clients + React hooks (useState/useEffect) using the `api` HTTP client from @atlashub/smartstack (pre-configured, returns unwrapped data) on the canonical API strata (integration: the NavRoute-resolved /api/{module}/{section}, or screens: /api/screens/{plural}).

Scaffold the per-project useAuth adapter + PermissionGuard

Generates React page components (list, detail, form) consuming @atlashub/smartstack npm package: PermissionGuard, Slot, SmartStackProvider. i18n catalogues are module-level (one JSON per module, one root key per entity); the CLI emits the already-merged full file (floor < existing < PRD) and writes it atomically.

Generates ExtensionConfig (@atlashub/smartstack) with slot definitions that mirror the <Slot name="..."> calls emitted by frontend/component.

Turns a generated CLIENT SmartStack app (an @atlashub/smartstack consumer) into an installable, offline-capable PWA: faithful socle service worker (tenant/language-isolated API cache), VitePWA injectManifest wiring, web manifest + meta tags, placeholder icons, the registerSW → package update channel bridge, initOutbox() and the offline-write outbox aggregation. Fail-closed on non-client web roots and on packages without the PWA channel.

Generates PageRegistry registrations for SmartStack's DB-driven routing (DynamicRouter). Validates componentKey format before emission and fails loud on bad specs rather than producing silent-spinner registries.

React + Vite + Tailwind + SmartStack frontend structure (npm consumer of @atlashub/smartstack)

Audits and auto-fixes React pages in a generated SmartStack frontend against the customisation-ui design system standards (CSS variable tokens, PageTemplate wrapper, DataTable/EntityCard components, lucide-react icons, semantic badges, permission keys, i18n namespaces). Produces a violation report (audit mode) or applies mechanical fixes (apply mode) based on tokens.json. Invoked after Phase 4 of ba-develop to guarantee visual consistency with the reference app.

Kill orphans + launch backend + frontend, auto-retry on failure

Kill stale .Api processes, launch dotnet run, verify /health — retry loop

Kill stale Vite, npm run dev, verify /, retry loop

Runtime smoke-test for a freshly-generated SmartStack.app project. Starts the backend (`dotnet run`) and the frontend (`npm run dev`) in the background, waits for both to become reachable, then probes every page route and every API endpoint scaffolded by the pipeline. Fails the run if ANY endpoint returns a 4xx/5xx status code or if any page is missing from disk. Designed to be the final gate of `ba-develop` so cross-stack drift surfaces in CI rather than at the user's first manual `npm run dev`.

Auto-correct a SINGLE compilation error surfaced by the Studio's Dev Runner (dotnet CS####, tsc TS####, vite resolve). The caller provides one `BuildError` with file/line/column/code/message. Your job is to apply the MINIMUM patch to make that specific error go away, without refactoring surrounding code. Invoked by `build-fix-runner.ts` in a retry loop (max 15 iterations, convergence guard, rebuild-and-reparse after each attempt).

Phase 5 UI tests — drives dev-browser to navigate every scaffolded page, submit forms with role-based seeded users, and auto-correct failures via the existing fix-bug skill loop (max 50 iterations per test). Runs after the frontend scaffolders complete (routes + component + api-client + extension-config) and verifies the full backend ↔ frontend round-trip.

HTTP smoke prober for generated SmartStack applications. Given a list of URLs (frontend routes + backend API endpoints), fetches each one, follows redirects, applies retry-on-startup, and returns a JSON report of 200/non-200 results. Invoked after Phase 4 of ba-develop to detect broken routes and missing API endpoints before the user ever sees a 404 in the browser.

Audit code generated by the Frontend phase against the PRD slice — page coverage, registry wiring, lazy-import integrity, i18n namespaces, drift detection

Audit the PWA / offline surface of a generated client app — tenant-isolated service worker markers, manifest icon chain, per-page mobile metadata, offline READ degradation, offline WRITE outbox wiring, the end-to-end IVersionedEntity rowversion chain, the registry-layout fail-closed gate and the precache cap vs built chunks (DEV-PWA-001..012)

Scaffold the page wrapper (PageTemplate) of the generated client app. The app chrome — desktop header/sidebar AND the mobile shell — is rendered by @atlashub/smartstack and is never scaffolded locally.

Bootstrap src/index.css with Tailwind v4 + Shoelace token overrides + design tokens from the PRD theme slice (or SmartStack defaults). Idempotent overwrite.

Scaffold theme-compliant UI primitives into the client project (EntityLookup combobox, DateInput inline calendar, EnumSelect + MultiSelect dropdowns, SegmentedControl, Textarea, Switch, TruncatedText + the owned base DataTable and its ResponsiveDataTable wrapper for responsive list tables with truncation tooltips, TabStrip scrollable tab bar with arrow nudges, SectionCard titled category card with the read-first per-section edit toggle, plus the modern kit Skeleton, EmptyState, Badge, StatCard, and the URL list-state layer useListState + SavedViewsMenu). Idempotent, honors @customised marker.

Audit acceptance-test coverage of BA Acceptance Criteria (DEV-TEST-001..004 + 008 + 011, BLOCKING — incl. stale-trait AC churn, stub assertions and parse-LOST ACs) and business-rule test parity (DEV-TEST-009, BLOCKING — every enforceable err rule of règles-métier.md carries a MODULE-SCOPED [Trait("BR", …)] test), plus advisory checks (DEV-TEST-005..007 anti-patterns; DEV-TEST-010 — the traced [Fact] body carries the status/error tokens its AC pins verbatim, warn). Deterministic, runs after /ba-develop Phase 4 (Acceptance Tests).

Consumes a module's PRD on disk (`prd.md` + 3 phase slices + `pagespecs/*.md` under `.smartstack/ba/<APP>/<MODULE>/`) and drives development through 6 sequential phases (Core → Entities → API Integration → API Screen-driven → Frontend → Acceptance Tests). Fully autonomous: gates between phases auto-heal on failure (max 25 retries per item); an unhealable failure is deferred as a blocker and the run continues — it never halts and never asks the user mid-run, surfacing all blockers in the final report. Invoked after `/ba-create-prd` + `/ba-audit-prd` (dev-ready GO, score ≥ 80).

Orchestrates multi-module development across applications by executing the phased plan from /ba-create-plan-development. Reads dev-plan.json, runs a preflight check, then drives wave-by-wave execution: for each wave, launches one /ba-develop subagent per module (parallel within a wave), runs compile/test checks between waves, and reports unified results. Fully autonomous like /ba-develop: it never halts — unhealable issues (preflight not-ready, wave blockers, inter-wave compile failure) are recorded as blockers and the run continues to the end, aggregating every module's blockers in the final report.

Fetches up-to-date library, framework, SDK and API documentation via the ctx7 CLI (Upstash Context7). Prefer this over web search whenever the user asks about a library, framework, SDK, API, CLI tool or cloud service — even well-known ones like React, Next.js, Prisma, Express, Tailwind, EF Core — because training data may lag behind recent releases. Keywords: library, framework, docs, documentation, SDK, API, package, npm, nuget, version, changelog, migration guide.

Drives a real Chromium browser from Claude Code and from Bash CLI — navigate pages, click elements, read DOM, take screenshots, run end-to-end checks. The SmartStack Studio uses this skill as the test engine for Phase 5 UI tests. Activate when the user asks to open a URL, click a button, test a web page, verify a rendered layout, reproduce a UI bug, submit a form, or script any browser interaction. Keywords: browser, navigate, click, screenshot, DOM, Chromium, Chrome, webpage, URL, visual test, UI verification, E2E.

EF Core migration workflow — create, squash, rebase-snapshot, apply, list, status. Applies the best practices of the global /efcore agents without MCP or external dependencies. Works against a single-assembly generated app (CoreDbContext + ExtensionsDbContext) or the multi-assembly Studio (StudioDbContext with Sqlite / Postgres / SqlServer migration projects).

GitFlow workflow — routes to colocated CLI commands (skills/gitflow/cli/) for deterministic execution

Verify version alignment between package.json and documentation

Detect and fix template drift between SmartStack.app (source of truth) and CLI templates

SmartStack global conventions — DB schemas, prefixes, namespaces

Launch SmartStack dev environment (backend + frontend + admin credentials)

Automatically generates technical documentation for SmartStack. Use this skill when: - User asks to create/generate documentation - User mentions "document", "documentation", "doc", "ERD", "schema" - User wants to document a module, table, tool, or test - After implementing a feature to generate its documentation Types: user module, developer tools, database ERD, testing tools

SmartStack project initialization via ss init

Lightning-fast search to answer specific questions - optimized for speed

Multi-category code review — security, architecture, performance

Validate CLI templates by checking that every imported component, type, and method signature documented in /templates/skills/ actually exists in SmartStack.app (develop). Catches the "documented-but-missing-symbol" class of drift (e.g. the historical EntityLookup paradox, now resolved by the ui-primitives scaffolder).

Verify that a React page (or the whole generated app) conforms to the SmartStack design system — design-system tokens instead of hardcoded colors, the theme's helper classes (.btn .btn-primary, .badge-*) instead of inline re-assembly, and the project's own page anatomy — then auto-fix the violations. Thin orchestrator over the ui-polish engine: it does NOT reimplement any audit/fix logic, it runs the deterministic ui-polish CLI (project-aware) and finishes the residual cases the CLI cannot map mechanically. Runs the FULL ruleset by default.

SmartStack project upgrade via ss upgrade

Utility skills for SmartStack CLI development

Validate that a scaffolded feature works end-to-end (compile, test, API smoke test)

Closes the loop the audits leave open: runs them, attaches each finding's REMEDY from the shared registry (`lib/remediation.ts`), executes the correctors that already exist (the `derive-*` CLIs in write mode, the audit CLIs' own `--mode apply`), re-runs the audits, and reports the delta — closed / persisting / INTRODUCED. It implements no fix of its own and never guesses: a finding that needs a business decision is handed off to the `create-*` skill that owns the document, by name. Use for « corrige l'audit », « applique les corrections », « ferme les findings », or right after `/ba-audit-run` or an `audit-dev-*` gate.

Publish part of a generated SmartStack client app as a PUBLIC API that THIRD-PARTY systems consume machine-to-machine — the surface an ERP, a partner portal or a nightly batch calls. Emits controllers under the one route prefix the platform whitelists for an external application, seeds the endpoint catalogue that makes them reachable, publishes a versioned OpenAPI + Postman contract with a breaking-change gate, and provisions a test client so the whole chain can be proven end to end. The platform already owns identity, token exchange, grants, rate limiting and audit — this skill wires a client extension into it. Use for "exposer une API à un partenaire", "API externe", "machine-to-machine", "intégration tierce", "clé d'API", "expose our data to their ERP".

Customize the login / authentication experience of a generated SmartStack client app, through two complementary levers. (1) configure-login WRITES CONFIGURATION the package reads: connection providers (Local password, Microsoft / Google OAuth, Entra ID SSO), the initial admin, and the email provider — into secret-safe appsettings. (2) scaffold-login-page SCAFFOLDS an editable login page OVERRIDE via the package's `extensions.pages[PAGE_KEYS.LOGIN]` seam (branding + UI-side masking of providers and the sign-up link). Neither edits the package; the default login UI ships in @atlashub/smartstack. Conversational, then invokes the colocated CLIs.

Turn a generated SmartStack client app into an installable PWA with offline pages — transform the existing app (service worker, manifest, icons, install/ update banners, outbox bootstrap) and enable offline per page: 'read' (SW GET cache, mutations disabled offline) or 'write' (outbox capture, optimistic 202, idempotent replay, 409 server-wins conflicts). Thin orchestrator: derives the rollout from the BA pagespecs (colocated derive-pwa-spec CLI), persists the approved choices back into the pagespecs (SSOT), then drives the deterministic scaffolders (scaffold-pwa, scaffold-entity/business --versioned, scaffold-api-client, aggregate-outbox, scaffold-routes, aggregate-component-registry, scaffold-component) and audit-dev-pwa. Use for "make the app a PWA", "page consultable hors ligne", "saisie offline", "mode hors connexion", "installable sur mobile".

Scaffold the PUBLIC (pre-auth) surface of a generated SmartStack client app: the home page (the `/` override), presentation pages (about, features, pricing, contact…) and a full marketing "site vitrine". Generates real, editable React pages + reusable sections (hero, features, split, CTA, FAQ, logos), wires them through the package's public seam (PublicRouteRegistry + extensions.pages), seeds i18n copy, and inherits the SmartStack theme. Conversational, then invokes the colocated scaffold-vitrine CLI. Use for "customise the home", "add a landing / about / pricing page", "build a vitrine / showcase site".

Audit the GENERATED SmartStack app's LIVE database for referential-integrity gaps — every column ending in `Id` that should be a foreign key but is covered by NO integrity constraint. Runs SQL against the real database (SQL Server via sqlcmd) and classifies each finding CRITICAL / EXEMPT / REVIEW. Use when verifying that generated entities have real FKs (Tenant, cross-module, Core references), after generation/upgrade, or on demand.

When a colocated SmartStack skill CLI fails unexpectedly at a CLIENT project — a stack trace on stderr, non-JSON stdout, an unexplained non-zero exit — OR when an audit envelope contradicts itself (a `dedupOf` mirror finding in err while its primary rule is ok on the same scope) or renders a verdict you can DEMONSTRATE wrong, you are NOT the CLI's maintainer: the files under ~/.claude are deployed copies (no sources, overwritten on update) and must NEVER be edited. This skill is the sanctioned path instead: VERIFY the failure is real (fail-closed evidence rule — reproduction, classification, never a hypothesis), check the installed CLI version against npm (a newer release may already fix it — propose the update, retest), attach what the CLI READ (`inputs[]`, scrubbed) and produce a deduplicated, reproducible report bundle + zip under .smartstack/support/ for the client to send to support@atlashub.ch. Use for « la CLI a planté », « erreur de la CLI », « bug du scaffolder », « deux règles se contredisent », « ce verdict est faux », a crashed `npx tsx skills/…` invocation, or a `cli.runtime-error` / `audit.rule-contradiction` blocker.

Conventions for WRITING tests in a SmartStack client extension, distilled from the SmartStack.app corpus and adapted to the extension context (IExtensionsDbContext, in-memory ExtensionsDbContext + a fake tenant, real SQL Server LocalDB integration). Backend: xUnit v3 + FluentAssertions 8.x + Moq. Frontend: Vitest + Testing Library + MSW. Organised by TYPE of test — one reference per type in references/. Read the matching reference file BEFORE writing or extending ANY test, when: - the user asks to "write/add tests", "génère les tests", "couvre X par des tests" - you create or edit a `*Tests.cs` (backend) or `*.test.tsx` (frontend) file - a new entity / handler / service / controller / hook / component / endpoint needs coverage Imitate the idioms below and the code the generators emit — do not invent a new style.

Apply DESIGN JUDGMENT to a generated SmartStack form/page that the deterministic scaffolder cannot infer — which FK is the signed-in user (the one-click "Me" shortcut), how to group fields into sections, which date is a primary inline calendar vs a compact popover, the column layout and the field order. Decides the judgment, then EITHER re-scaffolds the page through scaffold-component with explicit spec directives (the page stays regenerable) OR, for a layout no directive can express, edits the page and marks it @customised (the bespoke seam). The CLI renders; this skill decides. Pair with /ui-components, which fixes mechanical tokens — this fixes meaning and layout. Use when a generated page "works but reads wrong": wrong/missing "Me" button, a wall of calendars, ungrouped fields, off layout.

Full UAT pipeline for a generated SmartStack client app: generate a deterministic test plan (`.plantest.yml`) from the LIVE surface (SQL nav/RBAC + componentRegistry + controllers), provision a UAT tenant + one user per role through the admin API, execute the plan on BOTH axes — backend (every endpoint × role: expected status, duration, response size) and frontend (a real Chromium driven like a user: login page, sidebar clicks, row clicks, real form submits on UAT-marked data, per-page timings/weight/console) — and render a single-file HTML report with every metric. Use when the user asks to prepare or RUN UAT, verify role permissions end-to-end, or get a UAT report.

Cross-stack validation backend .NET / frontend React — 5 coherence checks

Static validation of SmartStack React conventions (5 architecture rules)

Deterministic scanner for a generated SmartStack project. Produces a structured JSON manifest of existing entities, migrations, seed providers, controllers, React pages, and extension registries. Consumed by each phase of ba-develop so the Claude subagent can distinguish "already implemented" from "needs to be created" before writing any file. Zero LLM — regex-based scan, runs under 2 seconds on a normal app.

LEGACY (hors chaîne BA) — score /100 aggregating roslyn + eslint + cross-validate only. NOT a dev-readiness verdict — it counts no AC coverage, no business rules, no RBAC parity, and nothing in the BA pipeline invokes it. The real dev readiness = the audit-dev-* gates (see banner).

SmartStack C# static analysis — 10 rules (SS001-SS010) per layer

Audits a SmartStack project for convention violations — namespace prefixes by Clean Architecture layer, entity patterns (BaseEntity + tenant interfaces + private ctor + factory), and controller routing (NavRoute vs hardcoded Route). Produces a structured JSON report of findings. Use when the user asks to audit, validate or check a project's conformance with SmartStack conventions. Keywords: audit, conventions, conformance, check project, validate structure, namespace, NavRoute, entity compliance.