garagon/nanostack

Compound documents what was learned during a sprint or significant fix by reading artifacts and writing structured solutions. Use it after /ship, a major bug fix, or an architecture decision worth remembering.

Conductor orchestrates parallel agent sessions through a sprint using file-based phase claims and handoffs. Use it to manage dependencies, claim work, complete artifacts, and coordinate review, security, and QA in parallel.

Feature adds a new feature to an existing project by running a full sprint workflow from planning through ship. Use it when the user already knows what they want and the codebase already exists.

Guard adds safety checks for destructive commands near production or sensitive systems. It can warn, freeze file writes to a scoped set of paths, or unfreeze back to careful mode.

License Audit lists the open-source licenses of a project's dependencies and groups them by license family. It flags GPL or AGPL dependencies when you need to assess copyleft risk before shipping.

License Audit checks the open-source licenses of direct project dependencies before release. It flags GPL or AGPL as blocked and unknown licenses as warnings.

Nano turns a validated idea into an executable implementation plan before code is written. Use it for non-trivial work like new features, refactors, or bug investigations that touch multiple files.

Nano Doctor checks a local nanostack install for dependency, permission, telemetry, and worker reachability issues. Use it when you need to diagnose whether the install is healthy or needs `--fix` or a reinstall.

Nano Help provides a quick reference for nanostack commands and what each one does. Use it to see available workflows and how to start the right command.

Nano Run configures nanostack for a first-time setup and guided first sprint. It checks existing state, handles legacy installs, and walks the user through permissions and work preferences.

Nanostack provides a local engineering workflow for AI agents, covering planning, review, security, QA, shipping, and parallel orchestration. Use it to guide non-trivial coding work and leave artifacts for each step.

Privacy Check scans a release for obvious personal-data collection signals like email forms, payment fields, or telemetry libraries. It is used before shipping to confirm a privacy note exists when collection is detected; it is not a legal review.

QA verifies that code works by testing browser UIs, native apps, CLIs, and APIs, then debugging and fixing failures. Use it for Playwright checks, computer-use testing, or root-cause analysis with re-verification.

Release Readiness composes upstream review, QA, security, license, and privacy evidence into a release verdict before /ship. Use it when you need a final OK, WARN, or BLOCKED decision from saved artifacts.

Review runs a two-pass code review after code changes: first for structural correctness, then for edge cases and failure modes. Use it when you want a thorough check of a diff, with depth that scales to the size of the change.

Security Audit performs OWASP Top 10 checks and STRIDE threat modeling against a codebase before shipping. Use it to review code, dependencies, secrets, CI, and other likely attack surfaces.

Ship takes code from done to verified in production by handling pre-flight checks, PR creation, CI, deployment, and post-deploy verification. Use it when you need to move changes through the full release pipeline.

Think sharpens a rough idea before code is written by asking questions, comparing approaches, and challenging scope. Use it to define the smallest useful starting point and save a brief for next steps.