opencode.jsonc

{
  "$schema": "https://opencode.ai/config.json",
  "instructions": [
    ".tfcore/core-config.yaml",
    ".tfcore/templates/v4custom/build-invocation-ladder.md",
    ".tfcore/templates/v4custom/opencode-operating-contract.md",
    "AGENTS.md"
  ],
  // Solo-dev TechieFlow v4: only the agents the compressed workflow actually uses.
  // Stock story-flow agents (dev/pm/po/qa/sm/ux-expert) were trimmed 2026-06-12
  // and are no longer included.
  //
  // NOTE on `tools` vs `permission`: the legacy `tools` key (e.g.
  // {write/edit/bash: true}) is deprecated and auto-normalized to a `permission`
  // block, and listing only three tools left read/grep/glob/task at their
  // defaults anyway. We use `permission` explicitly so intent is unambiguous.
  //
  // NOTE on git/gh: "GIT IS MANUAL" is enforced here for OpenCode the same way
  // `.claude/settings.json` + block-git.sh enforce it for Claude Code. Since
  // 2026-08-21 (YOLO / goal mode, .tfcore/tasks/_yolo-mode.md) the permission
  // map denies only git/gh WRITES (commit/push/add/reset/checkout/… and gh
  // pr|issue|repo|release create/merge/close/…) — those are blocked in EVERY
  // mode. READ-ONLY git/gh (status/log/diff/blame, gh pr list/view) is decided
  // by the plugin-bridged block-git.sh: blocked outside YOLO, allowed in YOLO.
  // The `rm */rmdir */sudo *` asks stay here; in YOLO the plugin's
  // `permission.ask` hook auto-approves them (and `opencode run --auto`
  // approves everything not denied). Verified at runtime (2026-08-20, OpenCode
  // 1.18.18): compound forms like `cd x && git log` ARE caught — OpenCode
  // tree-sitter-parses the command and checks each node.
  // TWO FOOTGUNS (both proven, DECISIONS.md 2026-08-19 §7):
  //   1. LAST matching rule wins. `"*": "allow"` must stay FIRST in every bash
  //      map; written after the denies it silently disables them.
  //   2. Agent-level `permission` rules are appended AFTER the root ruleset, so
  //      a bare `"bash": "allow"` on an agent VOIDS the root git/gh denies for
  //      that agent. Every agent below therefore repeats the full deny map —
  //      never collapse it back to `"bash": "allow"`.
  // Defense in depth: .opencode/plugin/techieflow.js additionally runs
  // block-git.sh (throw = block) upstream of this permission check.
  "permission": {
    "bash": {
      "*": "allow",
      "git commit*": "deny",
      "git push*": "deny",
      "git add*": "deny",
      "git rm*": "deny",
      "git mv*": "deny",
      "git reset*": "deny",
      "git checkout*": "deny",
      "git switch*": "deny",
      "git restore*": "deny",
      "git merge*": "deny",
      "git rebase*": "deny",
      "git cherry-pick*": "deny",
      "git revert*": "deny",
      "git clean*": "deny",
      "git am*": "deny",
      "git apply*": "deny",
      "git init*": "deny",
      "git clone*": "deny",
      "git pull*": "deny",
      "git fetch*": "deny",
      "git filter-branch*": "deny",
      "git filter-repo*": "deny",
      "git gc*": "deny",
      "git prune*": "deny",
      "git update-ref*": "deny",
      "git symbolic-ref*": "deny",
      "git replace*": "deny",
      "git update-index*": "deny",
      "git commit-tree*": "deny",
      "git write-tree*": "deny",
      "git read-tree*": "deny",
      "git fast-import*": "deny",
      "git send-email*": "deny",
      "git request-pull*": "deny",
      "git svn*": "deny",
      "gh pr create*": "deny",
      "gh pr merge*": "deny",
      "gh pr close*": "deny",
      "gh pr edit*": "deny",
      "gh pr comment*": "deny",
      "gh pr review*": "deny",
      "gh pr ready*": "deny",
      "gh pr reopen*": "deny",
      "gh pr lock*": "deny",
      "gh pr unlock*": "deny",
      "gh pr update-branch*": "deny",
      "gh pr checkout*": "deny",
      "gh issue create*": "deny",
      "gh issue close*": "deny",
      "gh issue edit*": "deny",
      "gh issue comment*": "deny",
      "gh issue delete*": "deny",
      "gh issue reopen*": "deny",
      "gh issue pin*": "deny",
      "gh issue unpin*": "deny",
      "gh issue lock*": "deny",
      "gh issue unlock*": "deny",
      "gh issue transfer*": "deny",
      "gh issue develop*": "deny",
      "gh repo create*": "deny",
      "gh repo delete*": "deny",
      "gh repo fork*": "deny",
      "gh repo clone*": "deny",
      "gh repo edit*": "deny",
      "gh repo sync*": "deny",
      "gh repo archive*": "deny",
      "gh repo unarchive*": "deny",
      "gh repo rename*": "deny",
      "gh repo set-default*": "deny",
      "gh repo deploy-key add*": "deny",
      "gh repo deploy-key delete*": "deny",
      "gh release create*": "deny",
      "gh release delete*": "deny",
      "gh release upload*": "deny",
      "gh release edit*": "deny",
      "gh workflow run*": "deny",
      "gh workflow enable*": "deny",
      "gh workflow disable*": "deny",
      "gh run cancel*": "deny",
      "gh run rerun*": "deny",
      "gh run delete*": "deny",
      "gh secret set*": "deny",
      "gh secret delete*": "deny",
      "gh variable set*": "deny",
      "gh variable delete*": "deny",
      "gh label create*": "deny",
      "gh label delete*": "deny",
      "gh label edit*": "deny",
      "gh auth login*": "deny",
      "gh auth logout*": "deny",
      "gh auth refresh*": "deny",
      "gh auth setup-git*": "deny",
      "gh gist create*": "deny",
      "gh gist delete*": "deny",
      "gh gist edit*": "deny",
      "gh ssh-key add*": "deny",
      "gh gpg-key add*": "deny",
      "gh cache delete*": "deny",
      "rm *": "ask",
      "rmdir *": "ask",
      "sudo *": "ask"
    }
  },
  "agent": {
    "flow-master": {
      "prompt": "{file:./.tfcore/agents/flow-master.md}",
      "mode": "primary",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "allow",
          "git commit*": "deny",
          "git push*": "deny",
          "git add*": "deny",
          "git rm*": "deny",
          "git mv*": "deny",
          "git reset*": "deny",
          "git checkout*": "deny",
          "git switch*": "deny",
          "git restore*": "deny",
          "git merge*": "deny",
          "git rebase*": "deny",
          "git cherry-pick*": "deny",
          "git revert*": "deny",
          "git clean*": "deny",
          "git am*": "deny",
          "git apply*": "deny",
          "git init*": "deny",
          "git clone*": "deny",
          "git pull*": "deny",
          "git fetch*": "deny",
          "git filter-branch*": "deny",
          "git filter-repo*": "deny",
          "git gc*": "deny",
          "git prune*": "deny",
          "git update-ref*": "deny",
          "git symbolic-ref*": "deny",
          "git replace*": "deny",
          "git update-index*": "deny",
          "git commit-tree*": "deny",
          "git write-tree*": "deny",
          "git read-tree*": "deny",
          "git fast-import*": "deny",
          "git send-email*": "deny",
          "git request-pull*": "deny",
          "git svn*": "deny",
          "gh pr create*": "deny",
          "gh pr merge*": "deny",
          "gh pr close*": "deny",
          "gh pr edit*": "deny",
          "gh pr comment*": "deny",
          "gh pr review*": "deny",
          "gh pr ready*": "deny",
          "gh pr reopen*": "deny",
          "gh pr lock*": "deny",
          "gh pr unlock*": "deny",
          "gh pr update-branch*": "deny",
          "gh pr checkout*": "deny",
          "gh issue create*": "deny",
          "gh issue close*": "deny",
          "gh issue edit*": "deny",
          "gh issue comment*": "deny",
          "gh issue delete*": "deny",
          "gh issue reopen*": "deny",
          "gh issue pin*": "deny",
          "gh issue unpin*": "deny",
          "gh issue lock*": "deny",
          "gh issue unlock*": "deny",
          "gh issue transfer*": "deny",
          "gh issue develop*": "deny",
          "gh repo create*": "deny",
          "gh repo delete*": "deny",
          "gh repo fork*": "deny",
          "gh repo clone*": "deny",
          "gh repo edit*": "deny",
          "gh repo sync*": "deny",
          "gh repo archive*": "deny",
          "gh repo unarchive*": "deny",
          "gh repo rename*": "deny",
          "gh repo set-default*": "deny",
          "gh repo deploy-key add*": "deny",
          "gh repo deploy-key delete*": "deny",
          "gh release create*": "deny",
          "gh release delete*": "deny",
          "gh release upload*": "deny",
          "gh release edit*": "deny",
          "gh workflow run*": "deny",
          "gh workflow enable*": "deny",
          "gh workflow disable*": "deny",
          "gh run cancel*": "deny",
          "gh run rerun*": "deny",
          "gh run delete*": "deny",
          "gh secret set*": "deny",
          "gh secret delete*": "deny",
          "gh variable set*": "deny",
          "gh variable delete*": "deny",
          "gh label create*": "deny",
          "gh label delete*": "deny",
          "gh label edit*": "deny",
          "gh auth login*": "deny",
          "gh auth logout*": "deny",
          "gh auth refresh*": "deny",
          "gh auth setup-git*": "deny",
          "gh gist create*": "deny",
          "gh gist delete*": "deny",
          "gh gist edit*": "deny",
          "gh ssh-key add*": "deny",
          "gh gpg-key add*": "deny",
          "gh cache delete*": "deny",
          "rm *": "ask",
          "rmdir *": "ask",
          "sudo *": "ask"
        }
      },
      "description": "Madhav — the TechieFlow master: build (*build-phase), fix (*fix-issues), triage (*triage-issues), log a miss (*log-miss), amend documents (*amend-docs), DevGuide and ProductGuide, handoff, refresh-status, metrics, HTML rendering, YOLO. The analyst owns day-1; the verifier owns *verify.",
    },
    "flow-architect": {
      "prompt": "{file:./.tfcore/agents/architect.md}",
      "mode": "all",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "allow",
          "git commit*": "deny",
          "git push*": "deny",
          "git add*": "deny",
          "git rm*": "deny",
          "git mv*": "deny",
          "git reset*": "deny",
          "git checkout*": "deny",
          "git switch*": "deny",
          "git restore*": "deny",
          "git merge*": "deny",
          "git rebase*": "deny",
          "git cherry-pick*": "deny",
          "git revert*": "deny",
          "git clean*": "deny",
          "git am*": "deny",
          "git apply*": "deny",
          "git init*": "deny",
          "git clone*": "deny",
          "git pull*": "deny",
          "git fetch*": "deny",
          "git filter-branch*": "deny",
          "git filter-repo*": "deny",
          "git gc*": "deny",
          "git prune*": "deny",
          "git update-ref*": "deny",
          "git symbolic-ref*": "deny",
          "git replace*": "deny",
          "git update-index*": "deny",
          "git commit-tree*": "deny",
          "git write-tree*": "deny",
          "git read-tree*": "deny",
          "git fast-import*": "deny",
          "git send-email*": "deny",
          "git request-pull*": "deny",
          "git svn*": "deny",
          "gh pr create*": "deny",
          "gh pr merge*": "deny",
          "gh pr close*": "deny",
          "gh pr edit*": "deny",
          "gh pr comment*": "deny",
          "gh pr review*": "deny",
          "gh pr ready*": "deny",
          "gh pr reopen*": "deny",
          "gh pr lock*": "deny",
          "gh pr unlock*": "deny",
          "gh pr update-branch*": "deny",
          "gh pr checkout*": "deny",
          "gh issue create*": "deny",
          "gh issue close*": "deny",
          "gh issue edit*": "deny",
          "gh issue comment*": "deny",
          "gh issue delete*": "deny",
          "gh issue reopen*": "deny",
          "gh issue pin*": "deny",
          "gh issue unpin*": "deny",
          "gh issue lock*": "deny",
          "gh issue unlock*": "deny",
          "gh issue transfer*": "deny",
          "gh issue develop*": "deny",
          "gh repo create*": "deny",
          "gh repo delete*": "deny",
          "gh repo fork*": "deny",
          "gh repo clone*": "deny",
          "gh repo edit*": "deny",
          "gh repo sync*": "deny",
          "gh repo archive*": "deny",
          "gh repo unarchive*": "deny",
          "gh repo rename*": "deny",
          "gh repo set-default*": "deny",
          "gh repo deploy-key add*": "deny",
          "gh repo deploy-key delete*": "deny",
          "gh release create*": "deny",
          "gh release delete*": "deny",
          "gh release upload*": "deny",
          "gh release edit*": "deny",
          "gh workflow run*": "deny",
          "gh workflow enable*": "deny",
          "gh workflow disable*": "deny",
          "gh run cancel*": "deny",
          "gh run rerun*": "deny",
          "gh run delete*": "deny",
          "gh secret set*": "deny",
          "gh secret delete*": "deny",
          "gh variable set*": "deny",
          "gh variable delete*": "deny",
          "gh label create*": "deny",
          "gh label delete*": "deny",
          "gh label edit*": "deny",
          "gh auth login*": "deny",
          "gh auth logout*": "deny",
          "gh auth refresh*": "deny",
          "gh auth setup-git*": "deny",
          "gh gist create*": "deny",
          "gh gist delete*": "deny",
          "gh gist edit*": "deny",
          "gh ssh-key add*": "deny",
          "gh gpg-key add*": "deny",
          "gh cache delete*": "deny",
          "rm *": "ask",
          "rmdir *": "ask",
          "sudo *": "ask"
        }
      },
      "description": "Optional deep architecture dive; /analyst covers day-1 architecture by default"
    },
    "flow-analyst": {
      "prompt": "{file:./.tfcore/agents/analyst.md}",
      "mode": "all",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "allow",
          "git commit*": "deny",
          "git push*": "deny",
          "git add*": "deny",
          "git rm*": "deny",
          "git mv*": "deny",
          "git reset*": "deny",
          "git checkout*": "deny",
          "git switch*": "deny",
          "git restore*": "deny",
          "git merge*": "deny",
          "git rebase*": "deny",
          "git cherry-pick*": "deny",
          "git revert*": "deny",
          "git clean*": "deny",
          "git am*": "deny",
          "git apply*": "deny",
          "git init*": "deny",
          "git clone*": "deny",
          "git pull*": "deny",
          "git fetch*": "deny",
          "git filter-branch*": "deny",
          "git filter-repo*": "deny",
          "git gc*": "deny",
          "git prune*": "deny",
          "git update-ref*": "deny",
          "git symbolic-ref*": "deny",
          "git replace*": "deny",
          "git update-index*": "deny",
          "git commit-tree*": "deny",
          "git write-tree*": "deny",
          "git read-tree*": "deny",
          "git fast-import*": "deny",
          "git send-email*": "deny",
          "git request-pull*": "deny",
          "git svn*": "deny",
          "gh pr create*": "deny",
          "gh pr merge*": "deny",
          "gh pr close*": "deny",
          "gh pr edit*": "deny",
          "gh pr comment*": "deny",
          "gh pr review*": "deny",
          "gh pr ready*": "deny",
          "gh pr reopen*": "deny",
          "gh pr lock*": "deny",
          "gh pr unlock*": "deny",
          "gh pr update-branch*": "deny",
          "gh pr checkout*": "deny",
          "gh issue create*": "deny",
          "gh issue close*": "deny",
          "gh issue edit*": "deny",
          "gh issue comment*": "deny",
          "gh issue delete*": "deny",
          "gh issue reopen*": "deny",
          "gh issue pin*": "deny",
          "gh issue unpin*": "deny",
          "gh issue lock*": "deny",
          "gh issue unlock*": "deny",
          "gh issue transfer*": "deny",
          "gh issue develop*": "deny",
          "gh repo create*": "deny",
          "gh repo delete*": "deny",
          "gh repo fork*": "deny",
          "gh repo clone*": "deny",
          "gh repo edit*": "deny",
          "gh repo sync*": "deny",
          "gh repo archive*": "deny",
          "gh repo unarchive*": "deny",
          "gh repo rename*": "deny",
          "gh repo set-default*": "deny",
          "gh repo deploy-key add*": "deny",
          "gh repo deploy-key delete*": "deny",
          "gh release create*": "deny",
          "gh release delete*": "deny",
          "gh release upload*": "deny",
          "gh release edit*": "deny",
          "gh workflow run*": "deny",
          "gh workflow enable*": "deny",
          "gh workflow disable*": "deny",
          "gh run cancel*": "deny",
          "gh run rerun*": "deny",
          "gh run delete*": "deny",
          "gh secret set*": "deny",
          "gh secret delete*": "deny",
          "gh variable set*": "deny",
          "gh variable delete*": "deny",
          "gh label create*": "deny",
          "gh label delete*": "deny",
          "gh label edit*": "deny",
          "gh auth login*": "deny",
          "gh auth logout*": "deny",
          "gh auth refresh*": "deny",
          "gh auth setup-git*": "deny",
          "gh gist create*": "deny",
          "gh gist delete*": "deny",
          "gh gist edit*": "deny",
          "gh ssh-key add*": "deny",
          "gh gpg-key add*": "deny",
          "gh cache delete*": "deny",
          "rm *": "ask",
          "rmdir *": "ask",
          "sudo *": "ask"
        }
      },
      "description": "Day-1 docs (*day1-brownfield / *day1-greenfield), UI mockups (*mockups), requirements split (*split-brd), doc amendments (*amend-docs), brainstorming, research"
    },
    "flow-verifier": {
      "prompt": "{file:./.tfcore/agents/verifier.md}",
      "mode": "all",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "allow",
          "git commit*": "deny",
          "git push*": "deny",
          "git add*": "deny",
          "git rm*": "deny",
          "git mv*": "deny",
          "git reset*": "deny",
          "git checkout*": "deny",
          "git switch*": "deny",
          "git restore*": "deny",
          "git merge*": "deny",
          "git rebase*": "deny",
          "git cherry-pick*": "deny",
          "git revert*": "deny",
          "git clean*": "deny",
          "git am*": "deny",
          "git apply*": "deny",
          "git init*": "deny",
          "git clone*": "deny",
          "git pull*": "deny",
          "git fetch*": "deny",
          "git filter-branch*": "deny",
          "git filter-repo*": "deny",
          "git gc*": "deny",
          "git prune*": "deny",
          "git update-ref*": "deny",
          "git symbolic-ref*": "deny",
          "git replace*": "deny",
          "git update-index*": "deny",
          "git commit-tree*": "deny",
          "git write-tree*": "deny",
          "git read-tree*": "deny",
          "git fast-import*": "deny",
          "git send-email*": "deny",
          "git request-pull*": "deny",
          "git svn*": "deny",
          "gh pr create*": "deny",
          "gh pr merge*": "deny",
          "gh pr close*": "deny",
          "gh pr edit*": "deny",
          "gh pr comment*": "deny",
          "gh pr review*": "deny",
          "gh pr ready*": "deny",
          "gh pr reopen*": "deny",
          "gh pr lock*": "deny",
          "gh pr unlock*": "deny",
          "gh pr update-branch*": "deny",
          "gh pr checkout*": "deny",
          "gh issue create*": "deny",
          "gh issue close*": "deny",
          "gh issue edit*": "deny",
          "gh issue comment*": "deny",
          "gh issue delete*": "deny",
          "gh issue reopen*": "deny",
          "gh issue pin*": "deny",
          "gh issue unpin*": "deny",
          "gh issue lock*": "deny",
          "gh issue unlock*": "deny",
          "gh issue transfer*": "deny",
          "gh issue develop*": "deny",
          "gh repo create*": "deny",
          "gh repo delete*": "deny",
          "gh repo fork*": "deny",
          "gh repo clone*": "deny",
          "gh repo edit*": "deny",
          "gh repo sync*": "deny",
          "gh repo archive*": "deny",
          "gh repo unarchive*": "deny",
          "gh repo rename*": "deny",
          "gh repo set-default*": "deny",
          "gh repo deploy-key add*": "deny",
          "gh repo deploy-key delete*": "deny",
          "gh release create*": "deny",
          "gh release delete*": "deny",
          "gh release upload*": "deny",
          "gh release edit*": "deny",
          "gh workflow run*": "deny",
          "gh workflow enable*": "deny",
          "gh workflow disable*": "deny",
          "gh run cancel*": "deny",
          "gh run rerun*": "deny",
          "gh run delete*": "deny",
          "gh secret set*": "deny",
          "gh secret delete*": "deny",
          "gh variable set*": "deny",
          "gh variable delete*": "deny",
          "gh label create*": "deny",
          "gh label delete*": "deny",
          "gh label edit*": "deny",
          "gh auth login*": "deny",
          "gh auth logout*": "deny",
          "gh auth refresh*": "deny",
          "gh auth setup-git*": "deny",
          "gh gist create*": "deny",
          "gh gist delete*": "deny",
          "gh gist edit*": "deny",
          "gh ssh-key add*": "deny",
          "gh gpg-key add*": "deny",
          "gh cache delete*": "deny",
          "rm *": "ask",
          "rmdir *": "ask",
          "sudo *": "ask"
        }
      },
      "description": "Vidur — autonomous verification (*verify ui|functional|all); writes verdicts into the checklist Requirements Status tables"
    },
    "trblazeui": {
      "prompt": "You are the TrBlazeUI sub-agent. Read `.opencode/command/trblazeui.md` (fall back, in order, to `.claude/commands/trblazeui.md`, `.claude/trblazeui.md`, `.trblazeui/TrBlazeUI-AI-Reference.md`) and fully adopt that persona and its operating guidelines — it is the authoritative persona. NuGet credentials are user-level (Windows native `%AppData%\\NuGet\\NuGet.Config`, macOS/Linux `$HOME/.nuget/NuGet/NuGet.Config`, Docker `/root/.nuget/NuGet/NuGet.Config` from `%USERPROFILE%\\.opencode-docker\\nuget\\NuGet.Config`); never put a PAT in the repository. In Docker, never assume a Windows config is decryptable and never install `maui-tizen`; verify the mounted config and use the Docker build ladder. If neither file exists (TrBlazeUI NuGet not yet deployed), report the exact source/auth failure instead of blindly running `dotnet build`. Otherwise act as an expert .NET/Blazor developer specializing in the TrBlazeUI component library: build UI screens to match the approved mockups (`docs/{AppName}-UIDesign.md` + `docs/mockups/*.html`), follow `docs/{AppName}-Coding-Standards.md`, tag work with `[REQ-UI-N]` in the checklist Remarks, log TrBlazeUI gaps to `docs/{AppName}-TrBlazeUI-Feedback.md`. Never run git or gh.",
      "mode": "all",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "allow",
          "git commit*": "deny",
          "git push*": "deny",
          "git add*": "deny",
          "git rm*": "deny",
          "git mv*": "deny",
          "git reset*": "deny",
          "git checkout*": "deny",
          "git switch*": "deny",
          "git restore*": "deny",
          "git merge*": "deny",
          "git rebase*": "deny",
          "git cherry-pick*": "deny",
          "git revert*": "deny",
          "git clean*": "deny",
          "git am*": "deny",
          "git apply*": "deny",
          "git init*": "deny",
          "git clone*": "deny",
          "git pull*": "deny",
          "git fetch*": "deny",
          "git filter-branch*": "deny",
          "git filter-repo*": "deny",
          "git gc*": "deny",
          "git prune*": "deny",
          "git update-ref*": "deny",
          "git symbolic-ref*": "deny",
          "git replace*": "deny",
          "git update-index*": "deny",
          "git commit-tree*": "deny",
          "git write-tree*": "deny",
          "git read-tree*": "deny",
          "git fast-import*": "deny",
          "git send-email*": "deny",
          "git request-pull*": "deny",
          "git svn*": "deny",
          "gh pr create*": "deny",
          "gh pr merge*": "deny",
          "gh pr close*": "deny",
          "gh pr edit*": "deny",
          "gh pr comment*": "deny",
          "gh pr review*": "deny",
          "gh pr ready*": "deny",
          "gh pr reopen*": "deny",
          "gh pr lock*": "deny",
          "gh pr unlock*": "deny",
          "gh pr update-branch*": "deny",
          "gh pr checkout*": "deny",
          "gh issue create*": "deny",
          "gh issue close*": "deny",
          "gh issue edit*": "deny",
          "gh issue comment*": "deny",
          "gh issue delete*": "deny",
          "gh issue reopen*": "deny",
          "gh issue pin*": "deny",
          "gh issue unpin*": "deny",
          "gh issue lock*": "deny",
          "gh issue unlock*": "deny",
          "gh issue transfer*": "deny",
          "gh issue develop*": "deny",
          "gh repo create*": "deny",
          "gh repo delete*": "deny",
          "gh repo fork*": "deny",
          "gh repo clone*": "deny",
          "gh repo edit*": "deny",
          "gh repo sync*": "deny",
          "gh repo archive*": "deny",
          "gh repo unarchive*": "deny",
          "gh repo rename*": "deny",
          "gh repo set-default*": "deny",
          "gh repo deploy-key add*": "deny",
          "gh repo deploy-key delete*": "deny",
          "gh release create*": "deny",
          "gh release delete*": "deny",
          "gh release upload*": "deny",
          "gh release edit*": "deny",
          "gh workflow run*": "deny",
          "gh workflow enable*": "deny",
          "gh workflow disable*": "deny",
          "gh run cancel*": "deny",
          "gh run rerun*": "deny",
          "gh run delete*": "deny",
          "gh secret set*": "deny",
          "gh secret delete*": "deny",
          "gh variable set*": "deny",
          "gh variable delete*": "deny",
          "gh label create*": "deny",
          "gh label delete*": "deny",
          "gh label edit*": "deny",
          "gh auth login*": "deny",
          "gh auth logout*": "deny",
          "gh auth refresh*": "deny",
          "gh auth setup-git*": "deny",
          "gh gist create*": "deny",
          "gh gist delete*": "deny",
          "gh gist edit*": "deny",
          "gh ssh-key add*": "deny",
          "gh gpg-key add*": "deny",
          "gh cache delete*": "deny",
          "rm *": "ask",
          "rmdir *": "ask",
          "sudo *": "ask"
        }
      },
      "description": "Expert .NET and Blazor developer specializing in the TrBlazeUI component library (REQ-UI-* builder). Use when integrating TrBlazeUI into existing Blazor applications, generating UI pages/components/layouts/forms/dashboards, theming, or any .NET/Blazor development with TrBlazeUI."
    },
    "techierag": {
      "prompt": "You are the TechieRag sub-agent. Read `.opencode/command/techierag.md` (fall back, in order, to `.claude/commands/techierag.md`, `.claude/techierag.md`, `.techierag/TechieRag-AI-Reference.md`) and fully adopt that persona and its operating guidelines — it is the authoritative persona. NuGet credentials are user-level (Windows native `%AppData%\\NuGet\\NuGet.Config`, macOS/Linux `$HOME/.nuget/NuGet/NuGet.Config`, Docker `/root/.nuget/NuGet/NuGet.Config` from `%USERPROFILE%\\.opencode-docker\\nuget\\NuGet.Config`); never put a PAT in the repository. In Docker, never assume a Windows config is decryptable and never install `maui-tizen`; verify the mounted config and use the Docker build ladder. If neither file exists (TechieRag NuGet not yet deployed), report the exact source/auth failure instead of blindly running `dotnet build`. Otherwise act as an expert .NET developer specializing in the TechieRag RAG + LLM management library: wire RAG via `TechieRagBuilder` / `ITechieRag` (`IngestAsync`/`SearchAsync`/`AskAsync`/`ChatWithRagAsync`), add unit tests under `tests/unit/Rag/`, tag work with `[REQ-RAG-N]` in the checklist Remarks, log gaps to `docs/{AppName}-TechieRag-Feedback.md`. Never run git or gh.",
      "mode": "all",
      "permission": {
        "edit": "allow",
        "bash": {
          "*": "allow",
          "git commit*": "deny",
          "git push*": "deny",
          "git add*": "deny",
          "git rm*": "deny",
          "git mv*": "deny",
          "git reset*": "deny",
          "git checkout*": "deny",
          "git switch*": "deny",
          "git restore*": "deny",
          "git merge*": "deny",
          "git rebase*": "deny",
          "git cherry-pick*": "deny",
          "git revert*": "deny",
          "git clean*": "deny",
          "git am*": "deny",
          "git apply*": "deny",
          "git init*": "deny",
          "git clone*": "deny",
          "git pull*": "deny",
          "git fetch*": "deny",
          "git filter-branch*": "deny",
          "git filter-repo*": "deny",
          "git gc*": "deny",
          "git prune*": "deny",
          "git update-ref*": "deny",
          "git symbolic-ref*": "deny",
          "git replace*": "deny",
          "git update-index*": "deny",
          "git commit-tree*": "deny",
          "git write-tree*": "deny",
          "git read-tree*": "deny",
          "git fast-import*": "deny",
          "git send-email*": "deny",
          "git request-pull*": "deny",
          "git svn*": "deny",
          "gh pr create*": "deny",
          "gh pr merge*": "deny",
          "gh pr close*": "deny",
          "gh pr edit*": "deny",
          "gh pr comment*": "deny",
          "gh pr review*": "deny",
          "gh pr ready*": "deny",
          "gh pr reopen*": "deny",
          "gh pr lock*": "deny",
          "gh pr unlock*": "deny",
          "gh pr update-branch*": "deny",
          "gh pr checkout*": "deny",
          "gh issue create*": "deny",
          "gh issue close*": "deny",
          "gh issue edit*": "deny",
          "gh issue comment*": "deny",
          "gh issue delete*": "deny",
          "gh issue reopen*": "deny",
          "gh issue pin*": "deny",
          "gh issue unpin*": "deny",
          "gh issue lock*": "deny",
          "gh issue unlock*": "deny",
          "gh issue transfer*": "deny",
          "gh issue develop*": "deny",
          "gh repo create*": "deny",
          "gh repo delete*": "deny",
          "gh repo fork*": "deny",
          "gh repo clone*": "deny",
          "gh repo edit*": "deny",
          "gh repo sync*": "deny",
          "gh repo archive*": "deny",
          "gh repo unarchive*": "deny",
          "gh repo rename*": "deny",
          "gh repo set-default*": "deny",
          "gh repo deploy-key add*": "deny",
          "gh repo deploy-key delete*": "deny",
          "gh release create*": "deny",
          "gh release delete*": "deny",
          "gh release upload*": "deny",
          "gh release edit*": "deny",
          "gh workflow run*": "deny",
          "gh workflow enable*": "deny",
          "gh workflow disable*": "deny",
          "gh run cancel*": "deny",
          "gh run rerun*": "deny",
          "gh run delete*": "deny",
          "gh secret set*": "deny",
          "gh secret delete*": "deny",
          "gh variable set*": "deny",
          "gh variable delete*": "deny",
          "gh label create*": "deny",
          "gh label delete*": "deny",
          "gh label edit*": "deny",
          "gh auth login*": "deny",
          "gh auth logout*": "deny",
          "gh auth refresh*": "deny",
          "gh auth setup-git*": "deny",
          "gh gist create*": "deny",
          "gh gist delete*": "deny",
          "gh gist edit*": "deny",
          "gh ssh-key add*": "deny",
          "gh gpg-key add*": "deny",
          "gh cache delete*": "deny",
          "rm *": "ask",
          "rmdir *": "ask",
          "sudo *": "ask"
        }
      },
      "description": "Expert .NET developer specializing in the TechieRag RAG + LLM management library (REQ-RAG-* builder). Use when integrating TechieRag into .NET applications - adding NuGet packages, configuring RAG pipelines, setting up LLM providers, implementing chat, tool calling, token tracking, and any AI/LLM feature powered by TechieRag."
    }
  },
  "command": {
    "techieflow:tasks:day1-brownfield": {
      "template": "{file:./.tfcore/tasks/day1-brownfield.md}",
      "description": "Day-1 master task for an EXISTING project: Architecture + BRD + Coding-Standards + .editorconfig + PROJECT-STATUS + CLAUDE.md + the screen-by-screen DevGuide (with per-screen screenshots) (+ one-Checklist migration if a dev plan exists), all HTML-rendered."
    },
    "techieflow:tasks:day1-greenfield": {
      "template": "{file:./.tfcore/tasks/day1-greenfield.md}",
      "description": "Day-1 master task for a NEW project: target Architecture + BRD + UI mockups + Coding-Standards + .editorconfig + PROJECT-STATUS + CLAUDE.md + UsageGuide, all HTML-rendered."
    },
    "techieflow:tasks:mockups": {
      "template": "{file:./.tfcore/tasks/mockups.md}",
      "description": "Greenfield UI design: docs/{App}-UIDesign.md (per-screen region→TrBlazeUI-control map) + rendered docs/mockups/*.html styled to look like TrBlazeUI. The build's visual contract + the verifier's visual baseline. Driven by /analyst."
    },
    "techieflow:tasks:split-brd": {
      "template": "{file:./.tfcore/tasks/split-brd.md}",
      "description": "Split the BRD into the one docs/{App}-Checklist.md (REQ-UI/FN/RAG/NFR-* in a single Requirements Status table)."
    },
    "techieflow:tasks:build-phase": {
      "template": "{file:./.tfcore/tasks/build-phase.md}",
      "description": "The single unified build: implement every open REQ (UI/FN/RAG/NFR) from the one Checklist by clustering and calling /trblazeui (from mockups) + /techierag as sub-agents; self-smoke (data + visual); chain the verifier. Driven by /flow-master."
    },
    "techieflow:tasks:fix-issues": {
      "template": "{file:./.tfcore/tasks/fix-issues.md}",
      "description": "Fixes the bugs in a folder of screenshots: triages and logs them, builds the fix through the builders in FIX mode, smokes, re-verifies the touched rows, closes the misses with the fix cost (tf-fix-close.sh). Driven by /flow-master."
    },
    "techieflow:tasks:log-miss": {
      "template": "{file:./.tfcore/tasks/log-miss.md}",
      "description": "The twenty-second record: one sentence from the owner becomes one miss record and one checklist line through tf-log-miss.sh. Never boots, never fixes. Driven by /flow-master."
    },
    "techieflow:tasks:triage-issues": {
      "template": "{file:./.tfcore/tasks/triage-issues.md}",
      "description": "Analyse-only front door for bugs a person found: reproduces each on its screen, logs it in the checklist and the telemetry through tf-triage.sh (demote, new, note, close), never edits code. Driven by /flow-master."
    },
    "techieflow:tasks:triage-and-fix": {
      "template": "{file:./.tfcore/tasks/triage-and-fix.md}",
      "description": "The owner's whole bug sequence in YOLO: compare every screen to its mockup, triage the reported bugs, log every root cause with its cost, fix, log every fix with its cost, refresh the metrics, one summary per step. Driven by /flow-master."
    },
    "techieflow:tasks:verify-phase": {
      "template": "{file:./.tfcore/tasks/verify-phase.md}",
      "description": "Verifies every checklist row in a scope (ui | functional | all | REQ list) against the running app: boots it, runs the seven checks in order through the tf-verify-* scripts, writes the verdicts into the checklist and the telemetry. YOLO by default. Driven by /verifier."
    },
    "techieflow:tasks:handoff-phase": {
      "template": "{file:./.tfcore/tasks/handoff-phase.md}",
      "description": "Final wrap-up: UsageGuide doc (test users + test plan + setup), PROJECT-STATUS → Handoff, HTML re-renders, Library-Feedback consolidation."
    },
    "techieflow:tasks:refresh-status": {
      "template": "{file:./.tfcore/tasks/refresh-status.md}",
      "description": "RECOVERY: rebuild PROJECT-STATUS.md from ground truth (checklist tables + working-tree files + fresh build — NEVER git; git is manual) after a session died mid-phase and the status gate never ran. Distrusts stale status; never edits source."
    },
    "techieflow:tasks:metrics-report": {
      "template": "{file:./.tfcore/tasks/metrics-report.md}",
      "description": "Development telemetry report (*metrics): reads the append-only docs/metrics/ streams (runs / gates / sessions / commits / misses) and writes docs/metrics/METRICS.md + .html — first-pass rate, gate catch distribution, escape rate, rework ratio, throughput, commit cadence, plus the miss report (what was missed, which phase/agent/model let it through, what the fixes cost). NEVER prints a figure that pools live with backfilled records, or app with library/docs. Never runs git."
    },
    "techieflow:tasks:render-workflow-docs": {
      "template": "{file:./.tfcore/tasks/render-workflow-docs.md}",
      "description": "Re-render the canonical trio: BRD.html + Architecture.html + PROJECT-STATUS.html (with NEXT COMMAND call-to-action)."
    },
    "techieflow:tasks:generate-html": {
      "template": "{file:./.tfcore/tasks/generate-html.md}",
      "description": "Render any markdown file(s) or a non-recursive directory to self-contained HTML using the shared shell."
    },
    "techieflow:tasks:amend-docs": {
      "template": "{file:./.tfcore/tasks/amend-docs.md}",
      "description": "Fold an evolving concept / changed requirements into the EXISTING day-1 docs IN PLACE: surgically amends BRD + Architecture (append-only IDs), ripples to PROJECT-STATUS / BRD §4 / checklists, re-renders HTML. Incremental alternative to re-running day1-*."
    },
    "techieflow:tasks:deploy-checklist": {
      "template": "{file:./.tfcore/tasks/deploy-checklist.md}",
      "description": "Deployment Checklist: the steps to put the application on its host, one document per hosting target, written after UAT from the owner's pipeline guidance document and the Stack answers Q9 and Q10 (docs/TechieFlow-Document-Schemas.md §3.10). Never deploys. Driven by /flow-master."
    },
    "techieflow:tasks:productguide": {
      "template": "{file:./.tfcore/tasks/productguide.md}",
      "description": "End-user Product Guide: screenshot-illustrated, task-oriented how-to manual for external users (what each screen is for + how to do things) — the user-facing sibling of the DevGuide, reusing its captured screenshots. Always MD + HTML. On-demand. Driven by /flow-master."
    },
    "techieflow:tasks:devguide": {
      "template": "{file:./.tfcore/tasks/devguide.md}",
      "description": "Generate/refresh the screen-by-screen Developer Guide: traces every screen/control from Razor page → service → data-access → stored proc/query, per user role, documenting the code AS BUILT. Single doc for small apps, split per role for large ones; --update refreshes only changed screens."
    },
    "techieflow:tasks:create-doc": {
      "template": "{file:./.tfcore/tasks/create-doc.md}",
      "description": "Create a document from a YAML-driven TechieFlow template (interactive, section by section)."
    },
    "techieflow:tasks:verify": {
      "template": "{file:./.tfcore/tasks/verify-phase.md}",
      "description": "The verifier's *verify. Boot the app, run the seven checks on every row in scope, write the verdicts."
    },
    "techieflow:tasks:metrics": {
      "template": "{file:./.tfcore/tasks/metrics-report.md}",
      "description": "The flow-master's *metrics. Read the telemetry streams and write the metrics report."
    },
    "techieflow:tasks:brainstorm": {
      "template": "{file:./.tfcore/tasks/facilitate-brainstorming-session.md}",
      "description": "The analyst's *brainstorm. Run a structured brainstorming session."
    },
    "techieflow:tasks:research-prompt": {
      "template": "{file:./.tfcore/tasks/create-deep-research-prompt.md}",
      "description": "The analyst's *research-prompt. Generate a well-structured research prompt."
    },
    "techieflow:tasks:research": {
      "template": "{file:./.tfcore/tasks/create-deep-research-prompt.md}",
      "description": "The architect's *research. Generate a well-structured research prompt."
    },
    "techieflow:tasks:create-project-brief": {
      "template": "{file:./.tfcore/tasks/create-project-brief.md}",
      "description": "Write the one-page project brief that day-1 takes as input: product, users, must-do, out of scope. The analyst's *create-project-brief."
    },
    "techieflow:tasks:create-deep-research-prompt": {
      "template": "{file:./.tfcore/tasks/create-deep-research-prompt.md}",
      "description": "Generate well-structured research prompts."
    },
    "techieflow:tasks:facilitate-brainstorming-session": {
      "template": "{file:./.tfcore/tasks/facilitate-brainstorming-session.md}",
      "description": "Run a structured brainstorming session; results land in docs/brainstorming-session-results.md."
    }
  }
}