EVA / prompt catalog
Each prompt is a self-contained artefact: metadata, body, examples, evals, and shell verbs in one place. 162 prompts across harness, rag, domain, and writing patterns.
ready · 50
-
auth-fail-open-auditv0.2.0 domainAuth fail-open audit
Hunts the specific shape where a dev-mode escape hatch becomes the production front door — an absent identity treated as "auth is off" rather than "the caller did not authenticate". Probes the running service without credentials.
-
devaqua-taxonomy-bridgev0.1.0 domainDEVAQUA content-tool ↔ repo-taxonomy join-key bridge
Add a verified join-key field linking an external content tool's human taxonomy (e.g. Notion lesson tags) to a repo-owned taxonomy (e.g. COACH milestone slugs), without retagging or guessing.
-
fleet-host-rolloutv0.1.0 domainFleet-host rollout (hermes runner estate)
Executes install.sh across tenant roots on a shared multi-tenant fleet host — rollouts, runner version bumps, tenant onboarding. Encodes the two absolute refusals (never dockerd / the docker group; never rsync or hand-edit onto a tenant), demands provenance and a green estate suite before rolling, and refuses to accept a green checkmark as verification.
-
fleet-ingest-triagev0.2.0 domainFleet telemetry ingest triage (hermes)
Answers "is the fleet registered and is telemetry flowing?" in one call, then walks the ingest chain — webhook → org → run → job → fleet push — to the exact broken link. Codifies the orphan-job failure mode and the seam that caused it.
-
mcp-provider-wirev0.1.0 domainWire a REST API as an MCP provider (pebble flow)
End-to-end flow for exposing an existing HTTP API as MCP tools through the pebble gateway — config, self-disable, registry dispatch, corpus entry, tests, and the two traps that mocked tests cannot catch (wrong auth scheme, wrong route).
-
pebble-toolsv0.1.0 domainFleet tools via the PEBBLE gateway
Discover and call fleet MCP tools (petrova, ares, hermes, traceo, github, Proof KB, …) through the one authenticated PEBBLE gateway at mcp.devarno.cloud, using the live /registry + session profiles.
-
petrova-adr-tradeoffv0.1.0 domainPETROVA ADR with trade-off framework
Architectural decision review — enumerate pains, options, rejection reasons, chosen + accepted trade. Drafts a decision doc.
-
petrova-autopilotv0.1.0 harnessPETROVA autopilot (lifecycle outer loop)
Reads readiness, picks the next petrova verb, dispatches via kick, and chains until DONE or operator gate.
-
petrova-bootstrapv0.1.0 domainPETROVA bootstrap (Day 1)
Bootstrap a bare-bones consumer repo into petrova shape (CLAUDE.md, MILESTONES.md, AGENTS.xml, docs/ scaffold).
-
petrova-boundary-auditv0.1.0 domainPETROVA boundary + privileged-path audit
Where can scripts/agents write to sensitive surfaces (workflows, secrets, IAM, db) without going through a reviewable PR? Propose typed verb gates.
-
petrova-changes-sincev0.1.0 domainPETROVA changes-since
What changed since {{since}} — git log + file deltas grouped by area, with intent summaries and privileged-path flags.
-
petrova-decision-docv0.1.0 domainPETROVA decision doc (ADR)
Author a dated, append-only decision doc at docs/decisions/YYYY-MM-DD-`slug`.md (MR-7).
-
petrova-declare-baselinev0.1.1 domainPETROVA declare baseline
Ratify a new fleet baseline (v2, v3, ...) as a decision doc in petrova-codes; verb pre-flight refuses if any MR audit check fails.
-
petrova-doc-freshnessv0.1.0 domainPETROVA doc freshness audit
Flag every docs/ file whose claims are now wrong because the underlying code changed and the doc didn't (MR-12 enforcement).
-
petrova-doctorv0.1.0 domainPETROVA doctor (preflight)
Read-only preflight — submodules, contract, registry entry, branch protection. Emits structured readiness JSON for petrova-autopilot.
-
petrova-drift-checkv0.1.0 domainPETROVA drift check
Probe rank-graph contradictions and named anti-shape drift; surface or resolve.
-
petrova-failure-triagev0.1.0 domainPETROVA failure-mode triage
Map an observed error/symptom to the closest PETROVA error code and prescribe the runbook recovery path adapted to this stack.
-
petrova-findingv0.1.0 domainPETROVA finding
Emit a raw finding at docs/findings/YYYYMMDD-HHMM-`slug`.md.
-
petrova-fleet-snapshotv0.1.0 domainPETROVA fleet snapshot
Produce or refresh fleet_snapshot.yaml for a slug from registry + remote state.
-
petrova-friction-classifyv0.1.0 domainPETROVA friction classifier
Classify a friction item: closed (trivial follow-up) / in-budget (small, lands now) / deferred (next-phase milestone — MR-2). When in doubt, defer.
-
petrova-governance-inventoryv0.1.0 domainPETROVA governance inventory
Read-only governance scan: surface every governance signal in this repo and gap-rate against PETROVA.
-
petrova-health-checkv0.1.1 domainPETROVA health check (5-dimension)
Five-dimension health snapshot: build, tests, docs freshness, decision-doc velocity, drift signals. Letter grade A–F.
-
petrova-install-playbookv0.1.1 domainPETROVA install playbook
Step 0 of consumer onboarding. Deposit the petrova playbook (META-RULES.md, 00-bootstrap.md, partials, progress schema) into a consumer repo's `.petrova/playbook/` so subsequent bootstrap prompts can resolve `{{...}}` references against literal local paths.
-
petrova-invariant-soakv0.1.1 domainPETROVA invariant soak
Runs an assertion table from the cycle.yaml against a staging slice. Each row is one project invariant (I-N) with a probe that yields pass | fail | skip.
-
petrova-milestone-addv0.1.0 domainPETROVA milestone add
Append a milestone entry to MILESTONES.md (used to land MR-2 deferred items).
-
petrova-mr-checkv0.4.0 domainPETROVA MR-1..21 audit
Audit a consumer repo against every meta-rule; emit a violations list and a progress signal.
-
petrova-north-star-alignv0.1.0 domainPETROVA north-star alignment audit
Sample recent commits/PRs and judge whether each served the north-star, load-bearing infra, or backlog (MR-1 enforcement).
-
petrova-onboardv0.2.1 domainPETROVA onboard
Initialise a registered consumer repo's mechanical petrova floor — write `.petrova/contract.yaml` + install the `docs-invariants` workflow, via the `petrova_onboard` verb.
-
petrova-phase-closev0.1.0 domainPetrova Phase Close
petrova-phase-close
-
petrova-phase-openv0.1.0 domainPetrova Phase Open
petrova-phase-open
-
petrova-plan-featurev0.1.0 domainPETROVA plan a feature
Translate a feature ask (vague or specific) into PETROVA-shaped scope: north-star sentence, tasksets with deliverable+verification+gate, reuse-first.
-
petrova-post-mortemv0.1.0 domainPETROVA post-mortem from audit trail
Reconstruct the trigger chain over a window from commits/PRs/CI, name where the audit trail had gaps, output what would have prevented this.
-
petrova-propose-fixv0.1.2 domainPETROVA propose fix
Open a fix PR bound to a prior diagnose run. Validates that the diagnosis_id resolves to a real recent diagnose output and that every proposed change carries explicit MR grounding.
-
petrova-request-merge-when-greenv0.1.1 domainPETROVA request merge when green
Open a PR with auto-merge enabled. Profile-gated — only repos with branch protection that permits auto-merge can use this verb. Validates merge_method and grounding before composing the PR envelope.
-
petrova-request-reviewv0.1.1 domainPETROVA request review
Open a PR with explicit file changes and request human review. Validates operator-supplied grounding (decision docs, MR citations, north-star refs) before composing the PR envelope.
-
petrova-routine-archaeologyv0.3.0 domainPETROVA routine archaeology
Read-only scan that surfaces manual operations worthy of becoming Claude Code Routines; emits ranked candidate specs.
-
petrova-stalled-workv0.1.0 domainPETROVA stalled-work scan
Find PRs without recent activity, milestones not progressing, decisions open `14 days, findings without paired decisions, branches `30 days unmerged. Group: revivable / blocked / abandoned.
-
petrova-supersession-checkv0.1.0 domainPETROVA supersession check
Find every closed-status decision doc whose claims a proposed change would contradict; draft Supersedes: docs (never edits originals — MR-7).
-
petrova-upstream-watchv0.1.1 domainPETROVA upstream watch
Generic upstream-source poller. Cycle author declares the sources (PyPI, GitHub releases, RSS) and notify rules; this prompt classifies deltas as none | minor | breaking | unknown and routes escalations.
-
petrova-verify-roundv0.1.0 domainPETROVA verification round
Run the mandatory friction-probe verification round for an open phase (MR-10).
-
petrova-wire-aresv0.2.0 domainPetrova Wire Ares
Draft the ARES wire-decision doc and describe the manual contract.yaml evidence-block update; no dedicated wire-verb exists in petrova-codes.
-
petrova-wire-contract-driftv0.1.1 domainPETROVA wire-contract drift
Walks a contract repo (e.g. proto-schemas) HEAD against every consumer's gen/ checksum. Surfaces silent schema drift before it surfaces as a confusing build error.
-
petrova-wire-integrationv0.1.1 domainPETROVA wire integration
Flip a registered consumer's `.petrova/contract.yaml` integration block from pending → wired with a validated evidence object. Generic over ares/traceo/crumb/rocky/eva.
-
petrova-wire-traceov0.2.1 domainPetrova Wire Traceo
Draft the TRACEO wire-decision doc and describe the manual contract.yaml evidence-block update; no dedicated wire-verb exists in petrova-codes.
-
refactor-with-constraintsv1.4.0 domainRefactor with Explicit Constraints
Surgical refactor of a single file under named constraints; produces diff + rationale + risks.
-
session-handoffv0.1.0 domainSession handoff (agent → agent)
Writes the handoff a fresh agent can actually act on — verified facts separated from beliefs, the exact commands that produced them, what is deployed vs merged vs open, and what is still UNPROVEN. Refuses to hand over false greens.
-
task-acceptance-checkv0.1.1 writingTask acceptance check
Read-only verifier. Given a Task and a candidate completion artefact, scores each acceptance criterion line-by-line. Output is a structured pass/score block consumed by `tasks/complete`.
-
task-bundle-plannerv0.1.1 harnessTask bundle planner
Decompose a goal + acceptance criteria into a TaskBatch — a structured queue of single-pass tasks, each grounded in a /map node with pre-bound args. Used by `eva tasks sync` to populate the EVA task backlog.
-
verify-email-flow-harnessv0.1.0 domainVerify end-to-end email flow for any app
Plug-in e2e verification of magic-link email flow — dispatch, read the mail over IMAP, click-through in headless Chromium, session assertion. Generic over app base URL, dispatch path, and probe email.
-
verify-for-realv0.2.0 domainVerify for real (anti-false-green)
Refuses the ways a green signal lies — exit code from the wrong process, a cancelled job read as a pass, a suite that is green because of the bug, a suite that collected zero tests, "tests pass" mistaken for "it works", and a broken measurement reporting absence as a clean negative. Drives the real system before any completion claim.
tested · 6
-
eva-cyclev0.1.0 domainEVA cycle — phase-boundary chain
Run the phase-boundary chain (verify-round → phase-close → optional phase-open); halt at first FAIL and draft a decision doc if an invariant slipped.
-
handbook-section-generatorv0.5.0 writingGenerate a Handbook Section from Notes
Synthesises bullet-form notes into a named handbook section in a chosen voice; surfaces contradictions.
-
mac-lab-bringupv0.1.1 domainMac lab bring-up (one org's offload lab on the Mac's external drive)
Gives one org its own test lab on the operator's Mac. That means an APFS sparse bundle on the external drive, Postgres and Redis on loopback ports no other lab uses, the `lab run` recorder, and labtop. Encodes the traps a first lab hits — exFAT drives, non-login PATH, the wrong Postgres major, the locale crash and the zsh word-splitting of ssh options.
-
mac-lab-offloadv0.1.3 domainMac lab offload (run a heavy suite on an org's Mac lab, against a baseline)
Runs one repo's heavy verification on the org's Mac lab instead of the workstation, recorded with `lab run` so the operator watches it in labtop. It works for a DB-backed Go suite, a full vitest run or a production build. Private dependencies are packed on the workstation, so the lab never holds a credential. The candidate is compared against a baseline by failing test NAME, and runs report skips and recovered panics instead of trusting the exit code.
-
orchestrate-multistepv0.3.0 harnessMulti-step Orchestration Executor (autopilot-shaped)
Executes one step of a JSON plan; emits strict-JSON handoff with predict/wake/learn fields per autopilot loop semantics.
-
prose-humanizev0.2.0 writingProse humanize: lint, rewrite, fact-diff, re-lint
Takes one piece of prose and a voice, strips the AI-writing tells catalogued by blader/humanizer (pinned v3.1.0@225a6f3), and returns a rewrite that says exactly what the original said. The deterministic humanize-lint gate runs before and after; a fact diff sits between them, so no tell is ever removed by inventing something.
draft · 106
-
abacus-vocabularyv0.1.0 harnessAbacus Vocabulary
Add or change a shared term in abacus _refs/vocabulary.yaml and carry it through the cheat sheet, ledger snapshot and asgard parity test, or explain how a service loads the vocabulary.
-
action-ref-reachabilityv0.1.0 domainAction ref reachability, prove every uses ref resolves from its org
Sweeps the workflows of a set of repos, classifies every `uses:` reference as reachable, unreachable across orgs, ref-missing or local, and recommends vendoring or inlining with a job-level guard. Proves each fix with the last failing run and the first run after the fix.
-
airlock-pattern-b-consumerv0.1.0 domainAirlock Pattern B consumer (cross-apex handoff sign-in for a Next.js app)
Wires a Next.js app on its own apex to sign in through devarno-cloud airlock's cross-apex handoff. It verifies the 60-second EdDSA handoff token against the airlock JWKS, sets a host-only session cookie, and optionally mints the app's own downstream token server-side. Field-derived from chronicle-cat/app#44 (2026-10-15).
-
brand-asset-generatorv0.1.0 writingBrand Asset Generator
Read BRAND.md + PRODUCT.md and emit a complete BRAND_ASSETS.md with image-gen prompts, palette, and typography for every named surface.
-
ci-free-nightly-flipv0.1.0 domainCI-FREE phase 4 per-org flip (gate CI from push/PR to a no-App nightly batch)
Moves one org's gate CI off push and pull_request onto a per-repo nightly-gates.yml that runs only when the default branch moved, using the repo's own GITHUB_TOKEN. Content differs per repo, so it reads each repo's workflows, splits remote-only jobs out, routes dormant repos to dispatch-only, and records an org decision. The human merges.
-
content-arc-declarev0.1.0 harnessContent Arc Declare
Author or amend an org's arc manifest in abacus _arcs/ (through-line, acts, windows) so a planned content run becomes checkable, not just intended.
-
content-cont-syncv0.1.0 domainContent CONT sync — show a sweep's cards as tasks in the private Orbit project CONT
Step 3 of the content-signal-sweep (PLAY-022), interim surface. Plans one CONT task per card (title, class, product, a link to the card) with prompts/_shared/orbit/cont_cards.py, posts the plan through the Orbit MCP, and reconciles status from abacus. Done only when a human abacus 00-inbox commit carries the card id.
-
content-decision-intakev0.1.0 domainContent Decision Intake
Gate A — read a closed, countersigned decision doc from a governed repo and, only if it's eligible, emit it as a ledger-artefact into abacus for drafting.
-
content-diagnosev0.1.0 domainContent diagnose — per-app D1 to D5 card from scanned signals and gate state
Step 1 of the content-signal-sweep (PLAY-022). Reads the multi-repo commit scan and each enrolled app's gate state, decides whether class D is open, and writes one diagnosis card per app. Read-only.
-
content-publish-sinkv0.1.0 harnessContent Publish Sink
Generalizes DOWNLINK Publish's regenerate-verify-drift-check-commit sequence to any org's own render surface, not just landing.
-
content-social-dispatchv0.3.0 domainContent Social Dispatch
Gate D — ask CELIA, through the asgard launch engine, to dispatch one approved, FLIGHT-countersigned social artefact. Dry-run first; posts only when the engine's dispatcher is live. The only prompt that leads to a post.
-
content-suggestv0.1.0 domainContent suggest — ranked suggestion cards per app, through a platform lens
Step 2 of the content-signal-sweep (PLAY-022). Turns each diagnosed signal into suggestion cards in the classes that are open, at most five per app per sweep, then lets code drop what the rules forbid. Output is a feed file. Suggestions only.
-
crumb-extraction-harnessv0.1.0 domainCRUMB Extraction Harness
Harness-pattern orchestrator that fans out background subagents across {{target_repos}}, dispatching the crumb-flashcard-extractor per repo with Ruflo memory/KG/intelligence enrichment and autopilot-shaped JSON handoff.
-
crumb-flashcard-extractorv0.3.1 writingCRUMB Flashcard Extractor
Scan a source repository and emit CRUMB-schema flashcards (20-field strict frontmatter, mermaid-first diagrams) ready to drop into crumb.devarno.cloud.
-
dead-man-heartbeatv0.1.0 domainDead-man heartbeat, prove the watcher can fail without the watched
Rebuilds a liveness or staleness check so it runs independently of the job it watches, sets its threshold from measured cadence plus scheduler lag, and proves it on both arms (a planted stale artefact goes red, a fresh one goes green) plus an external vantage that catches "nothing ran at all".
-
deck-act-gov0.1.0 domainDeck act GO — the record that authorises one write to one host
Drafts the per-deck, per-act GO record (status proposed) that must exist before any write to a VPS deck — move, stop, firewall, DNS or provider API verb — with preconditions as refusal conditions, pass criteria, rollback and a spent line; then hands FLIGHT the ratification ask in plain English.
-
demo-coverage-auditv0.1.0 domainDemo coverage audit (screen → endpoint → table → seeded?)
Read-only map of every screen a prospect sees in a product, the endpoint that feeds it, the tables behind it, and whether the demo seeder fills it. Output is a ranked gap table. Field-derived from the sparki-tools scoping on 2026-10-18.
-
demo-identity-bootstrapv0.1.0 domainDemo identity bootstrap (Airlock invite → first sign-in → demo user id)
Gets a product's demo@ login into devarno-cloud airlock and reads back its user id for the product's demo env vars. It invites, halts for the operator's magic-link sign-in, then reads the id from the airlock database read-only. Never sets secrets. Field-derived from sparki-tools 2026-10-18/19 and smo1-io.
-
demo-seed-authorv0.1.0 domainDemo seed author (deterministic, guarded, resettable demo data for one product)
Writes or extends a product's demo seeder using the pattern proven in smo1-io purr-api (seed-demo) and sparki-tools api-engine (pkg/demo). A pure plan built from now, one transaction, seed and reset modes, demo-owned deletes only, an id+email guard, per-screen tests and a runbook. Opens one PR.
-
demo-tenant-provisionv0.1.0 harnessDemo tenant provision (fill a product's demo@ account with realistic data, end to end)
Drives one product from "no demo account" to "demo@ signs in to a populated, verified, resettable workspace". It runs the identity, coverage, seeder, env, reset, plan and verify steps in order, and halts at each operator gate. Field-derived from smo1-io (purr-api seed-demo, back-test) and sparki-tools (api-engine PRs 53, 60, 65 and 66, pilot, 2026-10-18/19).
-
demo-verifyv0.1.0 domainDemo verify (sign in as demo@, screenshot every page, check the runbook)
Drives the product as the demo login with Playwright after a reset, screenshots each page on the runbook checklist, checks each expected line, and posts a pass/fail status. Field-derived from smo1-io's manual checklist and the sparki-tools pilot.
-
discovery-briefv0.1.0 domainDiscovery Brief
PLAY-010 v2 step 3 — write the round's open interview questions from the operator's hypothesis and segment, with no pitch, into the private round dir.
-
discovery-scriptv0.1.0 domainDiscovery Script
PLAY-010 v2 step 3 — draft first-message script versions from the brief and the last round finding; after the operator approves one, record the sha256 the guard computed. The agent never sends.
-
discovery-shortlistv0.1.0 domainDiscovery Shortlist
PLAY-010 v2 step 2 — run the read-only scout CLI over the operator's public Bluesky rings and an operator-named segment, writing at most 30 candidates to a private round dir outside every git tree. Never contacts anyone.
-
discovery-synthesisv0.1.0 domainDiscovery Synthesis
PLAY-010 v2 round close — synthesise only from the operator's notes and outcomes.log, every claim citing a note; draft the round finding (one change for next round) and the app gate finding at result DEMAND-NOT-MET; write an aggregate-only round report. Never writes DEMAND-MET.
-
downlink-entry-authorv0.1.0 writingDOWNLINK Entry Author
Turn raw notes or a draft artefact into an abacus blog-post markdown file that projects onto devarno.com/downlink cleanly on the first try.
-
downlink-publishv0.1.0 harnessDOWNLINK Publish
Project abacus blog entries onto landing and verify the result, or check for drift between the two repos without touching anything.
-
downlink-social-repurposerv0.1.0 domainDOWNLINK Social Repurposer
Turn a shipped DOWNLINK entry into a platform-native social artefact (X thread, LinkedIn post, Bluesky post, or newsletter excerpt) through a per-platform lens.
-
estate-auditv0.1.0 domainEstate audit — one ranked "drive now" list per project, from gates to public exposure
Read-only. For one enrolled project (or every registry repo in coverage mode), runs nine lenses — gates, tracker, guide truth, loop exceptions, live truth, public surface, content pipeline, personal exposure and opportunities — reusing the latest artifact of the cycle that owns a lens when it is under seven days old, and ranks every finding into a "drive now" list that respects the project's holds and freezes. Field-derived from the Sparki audit of 2026-11-11.
-
estate-onboardv0.1.0 domainEstate onboard — bring one app onto TOLL, gates/CUPEL and Orbit, rail by rail
Orchestrates one app through the estate's rails in a fixed order, each with an entry check and a derived done condition - registry and contract, gates file with demand and TOLL gates, TOLL consumer (sandbox, then live by ruling), CUPEL leaves for code gates, an Orbit project seeded with metadata, staff guides, and a clean reconcile. It runs the existing prompt for each rail, stops at every operator act, and keeps a per-app ledger with the command that proves each rail.
-
eva-askv0.1.0 domainEVA ask — evidence-bound RAG answer
Answer a question with an evidence-bound RAG pipeline; emit answer, evidence, and a validator verdict. Refuses-with-gap on insufficient evidence.
-
eva-automation-installv0.1.0 domainEVA automation install — wire approved automations as reviewable specs
Turn each automate or segment verdict in .eva/phase-manifest.yaml into a guarded eva.automation.v1 spec, render it as a paste-ready Claude Code Routine (now) and an EVA cycle twin (migration target), and open one draft PR. Never merges, never creates Routines itself.
-
eva-automation-triagev0.1.0 domainEVA automation triage — which phase steps earn automation
Score every step in .eva/phase-manifest.yaml as automate, segment or keep-manual against a fixed rubric, citing which clauses held. Read-only; adds the triage block to the manifest.
-
eva-baselinev0.1.0 domainEVA baseline — ratify a new fleet baseline
Ratify a new fleet baseline after an all-PASS health pre-flight; declare the baseline with the live audit snapshot embedded. Refuses if the audit is red.
-
eva-cli-drift-recoverv0.1.0 domainEVA CLI drift recover — fix a script's contract mismatch against an installed external tool
A wrapper script assumed a CLI flag/subcommand shape an installed external tool no longer has. Diagnose the real contract, fix the script (not the invocation), verify, never bypass with a flag or env-var escape hatch.
-
eva-flowv0.1.0 domainEVA flow — plan, queue, and execute one step on a goal
Plan→Queue→Execute on a goal; plan the feature, emit an eva-task-batch, and advance exactly one step with a strict-JSON envelope.
-
eva-healthv0.1.0 domainEVA health — read-only governance gauntlet
Run the read-only governance gauntlet (doctor, drift, boundary, invariant, MR, supersession) and emit one PASS/WARN/FAIL table with evidence.
-
eva-nextv0.1.0 domainEVA next — predict the highest-leverage next prompt
Read EVA workflow state + fleet.context and pick the single highest-leverage next prompt; emit the dispatch envelope. Does not invoke.
-
eva-onboardv0.1.0 domainEVA onboard — bring a fresh repo into the fleet
Bring a fresh repo into the fleet end-to-end via the bootstrap prose flow, the operator registry-PR gate, and an idempotent onboard resume.
-
eva-phase-manifestv0.1.0 domainEVA phase manifest — what the current phase still needs to close
Resolve a PETROVA-wired repo's current phase and acceptance gates, assess each with dated evidence, and route every open gate to the prompts, skills, workflows or human actions that close it. Read-only; writes .eva/phase-manifest.yaml.
-
eva-plug-inv0.1.0 domainEVA plug-in — attach a PETROVA-wired repo to the EVA timeline
Chain eva-phase-manifest, eva-automation-triage and eva-automation-install for the current phase, halting at the first gate. Leaves the repo with a phase manifest, triage verdicts and, where justified, a draft PR of guarded automations.
-
eva-projectv0.1.0 domainEVA project — re-project HANDBOOK.md + command-manifest.json
Re-project the handbook + command-manifest pair from the live catalogue. The only writer of the pair.
-
eva-recoverv0.1.0 domainEVA recover — failure response on the latest red signal
Respond to the latest red signal — triage the failure, draft a decision doc with ≥2 alternatives, then plan the fix with halt gates and a verification round.
-
eva-tickv0.1.0 domainEVA tick — one governed petrova-autopilot iteration
Run a single governed petrova-autopilot iteration; pick and kick the next petrova verb and emit a progress_signal with predict_next and wake_seconds.
-
fleet-host-bringupv0.1.0 domainFleet-host bring-up (hermes, bare machine to serving host)
Takes a bare machine to a serving hermes fleet host under docs/runbooks/fleet-host-bringup.md, then hands it to fleet-host-deploy.md. Encodes the traps a new host hits that an existing one never does — go missing from install.sh, the runner label derived from the hostname, panel registration blocked without a per-fleet cert, host-level podman state that install.sh does not carry, and per-job (not per-host) migration caps.
-
fleet-podman-lock-triagev0.1.0 domainFleet podman lock / testcontainers triage (hermes)
Read-only triage for a hermes fleet tenant whose CI fails with podman `exceeded num_locks`, or with testcontainers readiness waits that "matched 0 times". Finds the tenant's real store, counts what holds the locks, reads the lock ceiling podman actually applies, and checks whether the tenant can read its own container logs. Hands any write to fleet-deploy-runner under the hermes runbook.
-
founding-discount-watchv0.1.0 domainFounding discount watch — will a capped, dated discount stop applying?
Triage the generated choco founding-discount report (scripts/cycle-discount-watch.sh). Reads the window and redemption halves, says whether the operator must unset choco-gateway's TOLL_CHECKOUT_DISCOUNT now, soon, or not yet, and what is unknown (an unread redemption count). Read-only.
-
gates-cupel-leafv0.1.0 domainGates CUPEL leaf — cut one agent-executable change under a gate into an admissible CUPEL ticket
Layer 3 of the gates-to-revenue pattern. Takes one code-shaped piece of work under a gate and writes it as a CUPEL ticket plus trace, with a RED command observed failing before GREEN, then links the trace from the gate's cupel list. Refuses work that cannot be made falsifiable - that stays gate work.
-
gates-drivev0.1.0 domainGates drive — one session moving a repo's gates toward revenue
Layer 2 of the gates-to-revenue pattern, for one repo. Derives gate state with the validator, then takes the next movable thing - an agent-ready gate, a draft that turns an operator ruling into approve-or-close, a walk kit for a non-engineer - and records every move as evidence, never as an edited status.
-
gates-mapv0.1.0 domainGates map — find what stands between a repo and revenue, as derived-state gates
Layer 1 of the gates-to-revenue pattern. Reads a repo's milestones, decisions, billing path and live surfaces, and writes .petrova/gates.yaml (schema gates/v1) with the validator and its CI step, so every gate's state is derived from evidence files rather than typed in.
-
gates-rulev0.1.0 domainGates rule — draft the decision record a ruling blocker waits on
Reads the evidence behind one uncleared ruling blocker and drafts a decision record that sets out the question, the options and a recommendation, with an unticked countersign. The operator countersigns it on jzero /approvals and gates-scribe then clears the blocker, so the ruling is made without the operator editing a file.
-
gates-scribev0.1.0 domainGates scribe — record rulings that were already made
Finds ruling blockers whose evidence file already exists but whose cleared_by was never set, confirms each file records the ruling with a human sign-off, and sets cleared_by for the confirmed ones in one PR per repo.
-
gates-sweepv0.1.0 domainGates sweep — the estate-wide queue between every repo and revenue
Layer 2 of the gates-to-revenue pattern, across the estate. Reads every registered repo's .petrova/gates.yaml from its default branch via the GitHub API, derives state with the shared validator, and reports what waits on the operator, what an agent can take, what a non-engineer can walk, and which repos have no gates yet. Read-only.
-
gha-estate-batch-editv0.1.0 domainGitHub Actions estate batch edit (many orgs, one mechanical change)
Applies one mechanical workflow change (timeout-minutes, cron cadence, trigger removal) across many repos and orgs as one PR per repo, without spending CI minutes and without overriding a governed repo's own rules. Encodes the CI-FREE 2026-10-14 field lessons — skip-ci on both the commit and the squash subject, lint-neutral against base, governed orgs routed through their own decision process, and the human merging.
-
gha-governed-org-nightly-flipv0.1.0 domainGitHub Actions nightly flip for a governed org (security gates, decision first)
Plans the CI-FREE push-to-nightly trigger flip for one org whose gates protect security code, and gets it approved as a proposed decision doc before any workflow is touched. Encodes the nestr-tools 2026-10-15 field lessons — advisory pre-merge gates on free-plan private repos, host-bound "local-ok" jobs, arch pins in code, orphaned petrova workflows, stale dependabot PRs, and the human signing off.
-
gha-oidc-machine-identityv0.1.0 domainGitHub Actions OIDC as a route-scoped machine identity
Admits one GitHub Actions workflow to a service through OIDC workload federation instead of a stored token — a second issuer verified against GitHub's JWKS, an exact allowlist on numeric ids and workflow_ref, a fixed least role, a route and method scope, and a client that fetches the token just in time and pins it to one origin.
-
github-org-rename-migrationv0.1.0 domainGitHub org-rename migration (package identity, module paths, CI references)
Moves everything that still resolves through GitHub's rename redirect after an org rename — npm scopes on GitHub Packages, Go module paths and tags, GOPRIVATE/insteadOf rewrites, .gitmodules, workflow repository guards — in producer-to-consumer order, while leaving runtime wire identifiers, secret names and historical docs alone.
-
hermes-retire-fleetv0.1.0 harnessHERMES retire fleet (eu-1 out with no successor, plus the sparki worker lane)
Conducts a bounded fleet of subagents through the hermes plan that retires hermes-fleet-eu-1 with no replacement host. Gate tooling is built test-first, every org lane closes on `hermesctl retire-gate` going red to green, the box is decommissioned only under the fleet-safety-gate, and the sparki CX33 worker lane runs alongside. Purchases, cancellations, key revocation, countersigns and merges stay the operator's.
-
hetzner-cost-auditv0.1.0 domainHetzner cost audit (estate infra spend)
Read-only audit of what the devarno estate is paying Hetzner for, and what the next invoice should be. Enumerates every billable Cloud resource through the hcloud CLI (one context per project), lists the Robot boxes, and checks both against the documented baseline. Anything unexplained is reported as a cost to chase, not deleted.
-
impeccable-handbook-generatorv0.1.1 writingImpeccable Handbook Generator
Inspect a freshly /impeccable-onboarded project and emit a project-specific IMPECCABLE_HANDBOOK.md plus skeleton sidecar.
-
impeccable-harness-executorv0.3.0 domainImpeccable Harness Executor
Deterministic orchestrator that drives an IMPECCABLE_HANDBOOK.md to completion via Claude Code Task() sub-agents.
-
knowledge-dupes-reviewv0.1.0 domainKnowledge dupes review — one home per lesson, across every store
Triage the estate's duplicate-cluster report from scripts/knowledge-census.py. Labels each cluster as a dup (the same act or lesson filed twice) or a topic (related, cross-link only), names the routed home per the estate knowledge routing ruling, and proposes the pointer or cross-link for each copy. Read-only.
-
landing-claims-ledgerv0.1.1 domainLanding claims ledger (every sentence on the public surface, traced to the code a customer can actually use)
Read-only. Classifies every claim on an org's public surface (copy, captions, tables, alt text, metadata, share card) and traces it to the mechanism at a named commit, with a verdict and a customer-usable-today test. Field-derived from traceo.cat (2026-10-21), where code existed for most false claims.
-
landing-context-mapv0.2.0 domainLanding context map (find the source and every document that binds an org's public surface)
Read-only first pass of the landing-truth method. Locates the landing source, the documents that bind its copy, structure and design, the org's pricing ruling and audience statements, and registers every conflict with what the operator says they want. Field-derived from traceo.cat (2026-10-21).
-
landing-funnel-integrity-auditv0.2.0 domainLanding funnel integrity audit (every path from arrival to signup works, on a phone, and reads right to crawlers)
Read-only, measured on the rendered page. Checks CTAs and links, one primary action per viewport, phone reach, contrast of the primary CTA and brand-colour text, metadata, share card, canonical, robots and sitemap, and layout defects such as empty bands and unsized images. Field-derived from traceo.cat (2026-10-21).
-
landing-truth-flowv0.1.1 harnessLanding truth flow (take one org's public surface to a true, slop-free page at the quality its price implies)
Drives one org's landing page through the landing-truth method: context, claims ledger, funnel, value fit, operator rulings, sweep PRs, live re-read. One step per call, halting at operator gates, with a JSON handoff. Org-modular: every step takes the org, site and repo as inputs. Field-derived from traceo.cat (2026-10-21).
-
landing-truth-sweepv0.1.1 domainLanding truth sweep (land the ruled fixes as draft PRs, one per concern, red-first, recorded in the org's own form)
The only writing pass of the landing-truth method. From the ledger, funnel audit, value-fit audit and the operator's rulings, opens draft PRs split by concern (hygiene, design tokens, claims), writes a red-first claim test, replaces false copy with ledger-true wording, holds commercially ruled rows, records the ruling in the org's governance convention, and verifies on the rendered build. Field-derived from traceo.cat (#364, #365, #366, 2026-10-21).
-
landing-value-fit-auditv0.1.1 domainLanding value-fit audit (who buys, what proof they need, which true features carry it, at the price asked)
Read-only. From the claims ledger and the binding context, maps each audience to the proof it needs and the TRUE features that supply it, holds the page to the quality its price implies, flags slop, and ranks the product surfaces to show first. Never promotes a feature the ledger did not mark TRUE. Field-derived from traceo.cat (2026-10-21).
-
live-truth-triagev0.1.0 domainLive truth — is every surface running what main says, and can the live gate take money?
Triage the generated live-truth report (scripts/cycle-live-truth.sh). Per surface, says whether production runs main, a failed or stuck deploy, or merged config never deployed; for the money path, whether the live TOLL gate is up, verifies webhooks and is watched. Ranks the operator acts and names what was unread. Read-only.
-
local-checkout-consolidatev0.1.0 domainLocal-checkout consolidation — one clean checkout per repo
Takes one repo's local sprawl (extra clones, sibling and .claude worktrees, merged branches, stale stashes) down to a single clean primary checkout on the default branch. Order is fixed — inventory, archive, operator gates, execution, verification. Nothing is deleted before it is bundled, and nothing the inventory cannot prove landed is deleted at all.
-
mary-governance-diagnosev0.2.0 domainMARY governance diagnose (P6-L3 GENERATED statements)
Read ONE mary.governance-snapshot.v1 run. Return at most five cited, label-GENERATED statements naming what needs attention, as strict JSON. Zero is a valid answer. A deterministic verifier (verify.sh) decides what renders.
-
meta-prompt-generatorv0.1.0 writingMeta-Prompt Generator (implementation-prompt architect)
Transforms "I want to do task X" into a rigorous, subagent-driven implementation prompt for a downstream coding agent — ground-truth-first, phased, diff-evidenced.
-
nonroot-container-volume-permissionsv0.1.0 domainNon-root container on a root-owned volume (chown then drop)
Fixes a distroless `:nonroot` image (UID 65532) that fails with "permission denied" on a volume the platform mounts root-owned, such as Railway's `/data`. The approved pattern starts the process as root, chowns only allowlisted paths under the mount with `os.Root` and `Lchown`, then drops to 65532 and proves the drop before any file or socket is opened.
-
operator-wizard-handoffv0.2.0 domainOperator wizard hand-off (refused or operator-only production steps, as one guided script)
When the permission classifier refuses a production step, or governance reserves it for the operator, prepare and rehearse everything read-only, then hand the operator ONE hardened wizard script built from the wizard template. It is not a pile of copy-paste commands. The agent then verifies independently and continues the chain. Encodes the traps a first hand-off hits — the wrong database on a shared server, a raw tty, a pager that looks like a stall, re-runs that hit done steps, "dry runs" that write, and full-restore rollbacks that fail on new dependents.
-
opportunity-scanv0.1.0 domainOpportunity scan — openings a project has earned and nobody has opened
Read-only. From an estate-audit's evidence, lists openings beyond the current gates — a write-up a real incident earned, a library worth extracting under its own licence, a marketplace or directory listing the product already qualifies for, a talk or case study, an integration a customer would expect — each with the evidence that earned it, the effort, the play that would carry it, and any hold it would cross.
-
orbit-docs-syncv0.1.0 domainOrbit docs sync — post one repo's family guides (or runbook copies) into a product's Orbit Docs
Fetches a guide (or runbook) directory from GitHub at an exact commit, checks family guides against the plain-language standard, uploads their screenshots, posts each page as a child of an operator-made parent page through the Orbit MCP, then writes the set's README onto the parent as an "I want to…" index linking the Orbit pages. Re-runs update in place.
-
orbit-gates-seedv0.2.0 domainOrbit gates seed — project one product's revenue gates into Orbit tasks for staff
Reads one repo's .petrova/gates.yaml, derives state with the shared validator, and reconciles the product's Orbit project against it through the Orbit MCP - one parent "Launch to revenue" task and one sub-task per unmet operator or non-engineer gate, matched by gate id so a re-run never duplicates. Orbit only shows the gates; the repo decides them.
-
orbit-guide-writev0.1.0 domainOrbit guide write — turn a product's support runbooks into plain-language family guides
Rewrites one product's engineering support runbooks as short task guides a non-technical family member can follow, in the style of the Chronicle guides - no code, ids, file paths or engineering words, "pass it to Alex", captioned screenshots - and commits them to the product repo beside the runbooks, checked by guide_lint.py. Facts come only from the runbooks; anything they do not settle becomes "ask Alex".
-
orbit-handoffv0.1.0 domainOrbit handoff — emit or resume a CUPEL handoff record for an Orbit task
Emit mode writes a CUPEL handoff record (handoffs/HO-<task>-<seq>.yaml) in the product repo, where every state claim carries the command that reproduces it, links it from a one-line Orbit task comment and labels the task handoff:open. Resume mode is CUPEL's HOLDDOWN gate - re-derive every claim of the latest record before touching anything, record what changed, then claim the task.
-
orbit-reconcilev0.1.0 domainOrbit reconcile — find where Orbit tasks have drifted from the gates they project
For every Orbit project seeded from a gates file, derives each gate's labels and state (gate_meta.py), reads the project's tasks, and reports drift with orbit_reconcile.py - Todo with a blocker, Backlog without one, Done but unmet, met but open, orphaned gates, people-owned gates with no task, and label drift. Report-only unless a tasks:write token is available, and even then fixes only labels and status; Source, relations and new tasks stay operator or browser asks.
-
petrova-wire-crumbv0.2.0 domainPetrova Wire Crumb
EXPERIMENTAL — describe intended CRUMB wiring shape; no backing verb in petrova-codes yet.
-
petrova-wire-evav0.2.0 domainPetrova Wire Eva
EXPERIMENTAL — describe intended EVA prompt-library wiring shape; no backing verb in petrova-codes yet.
-
petrova-wire-rockyv0.2.0 domainPetrova Wire Rocky
EXPERIMENTAL — describe intended ROCKY RAG wiring shape; no backing verb in petrova-codes yet.
-
product-surface-truth-auditv0.1.0 domainProduct surface truth audit (every control traced to work it really does, every number to its window and n)
Read-only. Before an app-UI redesign, traces each control on each product route to the handler behind it and asks whether it does the work it claims; traces each number to the metric, window and sample size the backend actually computes; and lists fabricated data (seed fallbacks, teaser charts, placeholder-as-default). Field-derived from the nestr web redesign (web#55-#63, engine#84, nestr#233, 2026-10-30).
-
public-exposure-auditv0.1.0 domainPublic exposure audit — is the project visible under the operator's name, and where is it missing
Read-only. For one enrolled project, checks every public place the operator's name lives (personal site, content ledger, social identities) for the project, and the project's own surfaces for the operator; counts ledger artefacts about it by stage; and lists the gaps — shipped work with no artefact, a personal site that only links, a product with no founder line, a ledger with nothing past the inbox. Aggregates only.
-
public-projection-syncv0.1.0 domainPublic projection sync, keep the static page equal to its ledger
Keeps a static public projection in step with a private ledger without the projection ever being produced by a clock, a moving pin or an agent-initiated deploy. Proves the projector is deterministic, pins everything it reads, signals staleness with a PR instead of a deploy, and hands the deploy to the operator.
-
qa-adversaryv0.1.0 domainQA adversary (independent re-derivation)
Fresh-session re-derivation of every "pass" verdict in the QA Check Register, without reading prior evidence, to catch confirmation rather than verification.
-
rag-chunk-rerankerv0.1.0 ragRAG Chunk Reranker (LLM-as-reranker with MMR diversity)
Reranks candidate chunks against a query, balancing relevance and MMR-style diversity; preserves input ids.
-
rag-context-synthesizerv0.1.0 ragRAG Context Synthesizer (cited answer with coverage report)
Composes a grounded answer from id-keyed chunks; cites by id; refuses on insufficient evidence.
-
rag-evidence-validatorv0.1.0 ragRAG Evidence Validator (faithfulness · groundedness · citation audit)
Audits a RAG answer against its source chunks; pairs each claim to supporting ids and flags unsupported spans.
-
rag-query-rewriterv0.1.0 ragRAG Query Rewriter (expand · decompose · HyDE)
Rewrites a user query for retrieval — expansion, decomposition, or HyDE — emitting a strict JSON plan.
-
railway-cost-censusv0.1.0 domainRailway cost census (per service, per cycle)
Read-only census of what the estate pays Railway, per service x environment, for one billing cycle. Reads the GraphQL usage API with the account token, attributes memory, CPU, egress and volume to each container, reconciles against the dashboard, and flags egress spikes, idle Postgres floors and dead projects. Also answers "should we move to another PaaS" with the pricing-shape check.
-
railway-dead-service-diagnosisv0.1.0 domainRailway dead database service (proxy resets, nothing behind it)
Diagnoses a Railway app that crash-loops with `connection reset by peer` to `*.proxy.rlwy.net` when the real cause is that the database service has no running deployment. Proves it read-only, then restores the service on its existing volume with `serviceInstanceDeployV2` and moves the app to the private `${{Postgres.DATABASE_URL}}` reference.
-
refusal-code-catalogue-maintenancev0.2.0 domainRefusal-code catalogue and snapshot (nestr umbrella)
Keeps nestr's refusal-code catalogue (`docs/specs/refusal-codes.yaml`) and its snapshot pinned to the exact engine and pellets-registry gitlinks in step. Every engine or registry gitlink bump runs `scripts/check-refusal-codes.sh --write-snapshot` in the same commit, so the bump goes by PR, not direct push.
-
repo-dag-executorv0.2.0 harnessRepo Audit DAG Executor
Drive a shell-script harness that dispatches Claude Code Task sub-agents against an audit DAG until every node verifies green.
-
repo-dag-generatorv0.1.0 writingRepo Audit DAG Generator
Audit a repository and emit state.md + graph.md + per-node prompts/*.md — the execution plan for a fleet of agents to finish the repo.
-
security-pr-review-loopv0.1.0 domainSecurity PR loop (worktree, TDD, independent review, fold, merge, pin)
The end-to-end loop for one security-sensitive change in a submodule of a governed umbrella. Implement in a fresh worktree off origin/main with TDD, get strict CI green, get an independent read-only security review, fold every MEDIUM+ finding into the same PR (re-review after a BLOCK), log LOW findings as gap rows, merge, then bump the umbrella gitlink one submodule per commit.
-
smtp-sender-triagev0.1.0 domainSMTP sender triage, prove why a transactional email was refused or lost
Traces a missing transactional email from the app log to the provider reply, separates refusal at submission from loss after acceptance, and proves the fix with a delivered message's headers. Treats DNS as a suspect only once the provider has accepted the message.
-
spec-blocked-feature-stopv0.1.0 domainSpec-blocked feature, stop before coding (three options, no silent relaxation)
Stops a change whose spec-correct default would block everything, because nothing yet exists that can produce the artifact the spec requires, or because flipping a setting would break production. Presents three options (build the missing tool and stay strict; stay strict and disclose the capability as unavailable; relax only through a decision with human sign-off) and researches before any flip.
-
surface-retirev0.1.0 domainRetire a surface — ordered teardown, DNS last
Takes a domain, app, service or whole deck out of service in the only safe order — consumers, router, probes, CI, DNS last — then writes the decision naming what it supersedes. The deck variant adds a 48-hour quiet watch and hands the subscription cancellation to the operator.
-
toll-consumer-onboardv0.1.0 domainTOLL consumer onboard (gate side: capabilities, spec, consumer tests, multi-consumer subject safety)
Lands the null0-toll side of onboarding one or more consumer apps. One PR proves (and if red, fixes) that one Polar customer can hold paid access in two consumers at once. It also registers each consumer's capability strings, declares adopted Polar products in toll.spec.yaml by exact name, pins each consumer with tests/consumers/<kid>.test.ts, and writes the operator's onboarding record into the cutover runbook. Secrets, TOLL_CONSUMERS and Polar writes stay with the operator.
-
toll-consumer-wavev0.1.0 domainTOLL consumer wave (onboard and wire several apps onto TOLL in one gated pass)
Orchestrates moving several apps onto the TOLL gate in one pass. G0 collects the operator's rulings. T runs toll-consumer-onboard once for every app, including the multi-consumer subject fix. O1 is the operator's TOLL_CONSUMERS and Polar gate. W runs toll-consumer-wire for each app in parallel isolated worktrees. V runs sandbox drills plus the cross-app same-customer probe. R records the result. Each phase hands off with an explicit gate, and nothing proceeds on an assumed GO.
-
toll-consumer-wirev0.1.0 domainTOLL consumer wire (move an app's checkout and access check onto the TOLL gate)
Wires one consumer app's server to the TOLL gate. Checkout goes through toll.checkout with a namespaced subject, and paid access is read from toll.entitlements with a short cache, an explicit timeout and fail-closed denial. For an app that already bills Polar directly, it moves the entitlement source to TOLL behind a flag, keeps the app's ledger, plan-change and refund logic, and stops the local webhook from deciding access. One PR in the consumer repo; secrets and flag flips stay with the operator.
-
toll-sandbox-matrixv0.1.0 domainTOLL sandbox matrix (prove a consumer's money paths on real sandbox Polar)
Runs success, decline, abandon, duplicate and out-of-order webhook, refund, cancel, plan change and revoke for one TOLL consumer against the real sandbox gate and sandbox Polar, with a recorded finding and a verify-reviewer. Includes a working lab harness and the way to hold Polar deliveries so that a late event is a first arrival, not a replay.
-
traceo-workspace-baseline-provisionv0.1.0 domainProvision a Traceo workspace and baseline for a petrova consumer
Provider-side counterpart to petrova-wire-traceo. Gets a consumer's traceo probe to ok by putting its baseline where production actually serves baselines from (traceo-cat/ariel baselines/*.md at the pinned ariel rev), creating a same-tenant workspace the sanctioned way, repointing the OIDC trust entry, and verifying with an authenticated GET and a probe run.
-
unit-economics-reviewv0.1.0 domainUnit economics review — what each app earns against what it costs
Triage the generated monthly unit-economics report (scripts/cycle-unit-economics.sh). Reads per-app revenue, Railway cost, gate progress and demand, and the PLAY-015 retirement proposals; names the one next operator act per app. Read-only.
no matches.